Secure data annotation
on your servers.
Deploy in your own Kubernetes cluster or fully air-gapped, so your data never leaves your environment. Single sign-on, roles in every team and an activity log of every action decide and record who works with it.
Your data never leaves your environment.
The Enterprise edition runs inside your own network, and you control every security setting of the instance.
Your servers or your Kubernetes cluster
Install Supervisely on your own servers, in a private cloud or in a Kubernetes cluster with the Helm chart. Data stays on your servers or in your own cloud storage, and there are no trackers built in.
Air-gapped when you need it
In offline mode, the instance and its agents need no internet access. Online, an instance reaches only a documented list of domains, so your firewall can block the rest.
Hardened by default
Platform services run on hardened, shell-less images with scanner findings fixed. Traffic runs over HTTPS with your own certificates, and every upload can pass your virus scanner before it is stored.
Single sign-on with the identity provider you already use.
People sign in with their company accounts, and an admin can make your provider the only way in.
OpenID Connect
Microsoft Entra ID, Okta or any other OpenID Connect provider. Choose which claims the login and email come from, and let in only people with the right roles in your provider.
LDAP
Sign-in against your company directory, for teams that keep their accounts there.
SSO only
Turn off built-in logins so that every account goes through your provider, and let in only people you have added.
Everyone gets only the access their work needs.
Every member of a team has a role, and the same person can be an Admin in one team and an Annotator in another.
Admin
Full access to the team, including its members.
Developer
Data, models and apps, without managing members.
Manager
Projects and labeling tasks, with no access to neural networks.
Reviewer
Labels, reviews and creates labeling tasks.
Annotator
Works only in the labeling tasks assigned to them.
Viewer
Can only view items in the team.
- Custom roles decide what each role may create, edit or remove.
- Restricted accounts and Guest Labelers keep contractors inside the teams and labeling tasks you give them.
- An allowlist decides which apps each person can run.
Every action is on record.
The activity log is your audit trail: who did what and when, from signing in to labeling a single object.
Who, what and when
Each record has the date, the member, the action and what it touched: a project, dataset, image, labeling task or member.
Every kind of change
Sign-ins; projects, datasets, images, objects, classes and tags created, edited or removed; members added or removed; exports, training and inference.
Yours to analyze
Download the log of a team, project, labeling task or member as a CSV file, or read it through the API.
Your data stays private, and it stays yours.
On every plan, what you upload is available only to you and the people you invite. Supervisely does not use your data or share it with anyone.
You own your data
You keep full ownership of everything you upload. Supervisely gets no rights to it beyond what the platform needs to work, and never uses it to train models.
Encrypted and hosted in the EU
Data is encrypted at rest. The Community Edition is hosted in Germany, in the EU, and an Enterprise instance keeps data wherever you deploy it.
Personal data anonymized
DICOM imports anonymize patient names and IDs by default, before anyone starts labeling medical images. The Anonymize Data app blurs faces and license plates in images and videos.
Frequently asked questions.
Another question about security or compliance? Ask us directly.
Contact usCan Supervisely run on-premise or air-gapped?
Yes, with the Enterprise edition. It runs on your own servers, in a private cloud or in a Kubernetes cluster, or in a network without internet access, so your data never has to leave your infrastructure.
Does Supervisely support single sign-on (SSO)?
Yes, in the Enterprise edition, through OpenID Connect providers such as Microsoft Entra ID and Okta, or through LDAP. Admins can choose which claims the login and email come from, admit only users with the right roles in the provider, and turn off built-in logins. Read the SSO guide.
Does Supervisely keep an audit log of user activity?
Yes. The activity log records who did what and when: sign-ins, changes to projects, datasets, images, objects, classes and tags, members added or removed, exports, training and inference. You can export it to CSV or read it through the API.
Who owns the data I upload, and where is it stored?
You do. You keep full ownership of everything you upload, and Supervisely does not use your data or share it with anyone. Data is encrypted at rest. The Community Edition is hosted in Germany, in the EU, and a self-hosted Enterprise instance keeps data on your own servers or in your own cloud storage.
Does Supervisely help with GDPR and HIPAA requirements?
Supervisely gives you the controls these rules call for. The Community Edition is hosted in the EU, and your data is never shared. For protected health information, Enterprise keeps data on your own servers or offline, while roles, single sign-on and the activity log control and record access, and DICOM imports anonymize patient names and IDs by default. Talk to us about your security review.