feat: privacy option where admins cannot easily see user data #660

New Issue

2025-11-11T14:28:26-06:00

GiteaMirror commented

2025-11-11 14:28:26 -06:00

Originally created by @darkvertex on GitHub (Apr 16, 2024).

Is your feature request related to a problem? Please describe.

Set up a shared instance of Open Web UI at work and employees are slightly uncomfortable with the idea that an admin can dump their personal conversations (even though it's "for work".)

Describe the solution you'd like
It'd be nice if conversations were more obfuscated or encrypted in some way that admins cannot easily dump all data when a sort of "private server mode" is enabled globally, and they can only reset user passwords or trash users, but not get to the convos.

Originally created by @darkvertex on GitHub (Apr 16, 2024). **Is your feature request related to a problem? Please describe.** Set up a shared instance of Open Web UI at work and employees are slightly uncomfortable with the idea that an admin can dump their personal conversations (even though it's "for work".) **Describe the solution you'd like** It'd be nice if conversations were more obfuscated or encrypted in some way that admins cannot easily dump all data when a sort of "private server mode" is enabled globally, and they can only reset user passwords or trash users, but not get to the convos.

GiteaMirror closed this issue

2025-11-11 14:28:26 -06:00

GiteaMirror commented

2025-11-11 14:28:26 -06:00

@Lanhild commented on GitHub (Apr 16, 2024):

@darkvertex That's a job for more roles. Currently there is admin and user.

What you're suggesting would need an additional role, or to completely remove the ability to download the database from the UI.

While I believe doing the latter would be a huge downgrade, it'd be the easiest as far as how I understand your point.

Now, your issue is not solvable as in the admin most certainly has access to the UI container anyway, which contains the database itself.

@tjbck I feel like this is a non-issue, what do you think?

@Lanhild commented on GitHub (Apr 16, 2024): @darkvertex That's a job for more roles. Currently there is `admin` and `user`. What you're suggesting would need an additional role, or to completely remove the ability to download the database from the UI. While I believe doing the latter would be a huge downgrade, it'd be the easiest as far as how I understand your point. Now, your issue is not solvable as in the admin most certainly has access to the UI container anyway, which contains the database itself. @tjbck I feel like this is a non-issue, what do you think?

GiteaMirror commented

2025-11-11 14:28:27 -06:00

@justinh-rahb commented on GitHub (Apr 16, 2024):

To be honest, yes, this feels unreasonable to me. If you're using some service such as a chat or messenger app for work/school, you can expect that admins have access to that content and you'll have no say in it.

@justinh-rahb commented on GitHub (Apr 16, 2024): To be honest, yes, this feels unreasonable to me. If you're using some service such as a chat or messenger app for work/school, you can expect that admins have access to that content and you'll have no say in it.

GiteaMirror commented

2025-11-11 14:28:27 -06:00