Role-based permissions
Compose roles from fine-grained permissions and scope each one to a person’s own work, their team, department, project or the whole workspace.
- Own
- Team
- Department
- Project
- All
Fine-grained control. Your servers.
DinoFlow runs on infrastructure you control. Permissions follow every person, guest and AI agent, sign-in can be protected with single sign-on and two-factor codes, and sensitive changes are written to an audit log.
Security & control
Fine-grained control. Your servers.
Granular access, strong sign-in and a full audit trail, with an AI layer that follows the same rules as everyone else.
Guests
Invite clients, contractors and partners as guests. They only see the projects they are added to, with the role you give them there.
- Invited projects only
- Per-project role
- No company-wide content
SSO and two-factor
Sign in through your identity provider with OpenID Connect, and protect local accounts with authenticator-app codes.
- OIDC single sign-on
- TOTP two-factor
- API tokens
Audit logs
Sensitive changes are recorded with who, what and when, so admins can answer questions without guesswork.
AI you control
Dino Brain works through the same API as the person asking. It sees and changes only what they could, never more.
- Acts with the user’s own permissions
- Read-only mode for agents
- Provider keys encrypted at rest
- Monthly token budget & usage dashboard
- Asks before any bulk change
Self-hosted with Docker
Run the whole stack on your own servers. Your work data stays in your database, on your network.
Try the controls
Change a role’s permissions and preview the result, then check a real two-factor code.
Roles and permissions
Build roles from fine-grained permissions and scope each to a person’s own work, their team, department, project or the whole workspace. Guests see only the projects they are added to.
Loading the interactive demo
Try it yourself0/2
- Change a permission or its scope
- Preview the workspace as another role
- Fine-grained permissions
- Own, team, department, project or all
- Guests with per-project roles
- Every change audited
Sign-in security and audit log
Protect accounts with authenticator-app two-factor codes, sign in through OpenID Connect or SAML, and review who did what in the audit log.
Loading the interactive demo
Try it yourself0/2
- Check a two-factor code
- Filter the audit log
- TOTP two-factor with recovery codes
- OIDC and SAML single sign-on
- Device sessions you can revoke
- Audit log of sensitive changes
Security questions
Is DinoFlow self-hosted?
Yes. DinoFlow runs on your own servers with Docker Compose, alongside MySQL, Redis and the Qdrant vector database. Your work data stays in your database, and AI requests go only to the model provider you choose to connect.
Can the AI change my data without asking?
No. Dino Brain acts only with the permissions of the person asking, bulk changes wait for that person’s approval, and administrators can switch agents to read-only mode. Automation rules that run agents act as the rule’s owner.
How secure is DinoFlow?
DinoFlow uses role and scope based permissions, per-project guest access, OpenID Connect and SAML single sign-on, authenticator-app two-factor codes, device sessions you can revoke, an audit log of sensitive changes and encrypted provider keys. Because it is self-hosted, your data stays on infrastructure you control.