Plexichat is built for on-prem and private-cloud deployments where key custody, data retention, and network boundaries are controlled by your organization.
Encryption at rest is rooted in your infrastructure. Use TPM 2.0 hardware when available, or configure PLEXICHAT_SYSTEM_KEY for containerized deployments that require software-backed keys.
Plexichat uses strong password hashing, multi-factor authentication, and tokenized sessions for secure access control.
Traffic protection is enforced per route, per user, and per IP with configurable burst windows.
External URLs are validated through a media proxy to reduce SSRF risk from avatars, embeds, and remote assets.
These controls map directly to the production deployment guide and keep key material safe.