Documentation

This guide covers everything you need to install, configure, and run LiteGRC and LiteAI. Both products are distributed as Docker images from our private container registry. You deploy them on your infrastructure and manage them with a license key from your customer dashboard.

How Licensing Works

Both products use the same licensing model. When you purchase a subscription, you receive a license key — a signed string that encodes your tier, resource limits, enabled features, and expiration date.

Key Concepts

• License key is version-independent. Your key works with any release of the product. When we ship an update, pull the new image and restart — your same key keeps working until its expiration date.
• License key is self-contained. The key is cryptographically signed (Ed25519). The product verifies it offline using an embedded public key. No internet required for basic validation.
• One key per product. If you buy the bundle, you get two keys — one for LiteGRC, one for LiteAI.
• Renewal = new key. When your subscription renews, you receive a new key with an extended expiration. Replace the old key and restart.

Setting Your License Key

Every product reads the license key from an environment variable at startup:

# LiteGRC
export LICENSE_KEY="LS-GRC-eyJsaWQiOiJMS..."

# LiteAI
export LITEAI_LICENSE_KEY="LS-AI-eyJsaWQiOiJMS..."

LiteAI also supports loading from a file or config:

# Option 2: File
echo "LS-AI-eyJ..." > ~/.liteai/license.key

# Option 3: config.yaml
license_key: "LS-AI-eyJ..."

Requirements

LiteGRC

LiteGRC is a full-stack compliance automation system. It consists of a FastAPI backend, a Next.js frontend, MySQL, Redis, MinIO (S3-compatible object storage), and Celery workers for background tasks.

Docker Compose Installation

1Authenticate with the Container Registry

Use the registry token from your customer dashboard:

docker login ghcr.io -u <your-username> -p <your-registry-token>

2Download the Compose File

Download the production docker-compose.litegrc.yml from your dashboard, or copy the template:

curl -O https://www.litesecurity.net/static/deploy/docker-compose.litegrc.yml

3Create Your Environment File

Create a .env file next to the compose file. All sensitive values go here — never in the compose file itself.

# .env — LiteGRC Configuration
# ──────────────────────────────────

# License (required)
LICENSE_KEY=LS-GRC-your-license-key-here

# Database credentials (choose strong passwords)
MYSQL_USER=grc_admin
MYSQL_PASSWORD=your-strong-db-password
MYSQL_ROOT_PASSWORD=your-strong-root-password
MYSQL_DB=litegrc

# Redis
REDIS_PASSWORD=your-strong-redis-password

# Object storage (MinIO)
MINIO_ROOT_USER=minio_admin
MINIO_ROOT_PASSWORD=your-strong-minio-password

# Security keys (generate with: openssl rand -hex 32)
ENCRYPTION_KEY=0000000000000000000000000000000000000000000000000000000000000001
JWT_SECRET=change-this-to-a-random-64-char-string-use-openssl-rand-hex-32xx

# Frontend URL (the URL where your users access the app)
CORS_ORIGINS=["https://grc.your-company.com"]
PUBLIC_API_URL=https://grc-api.your-company.com

# Optional: License portal for heartbeat
LICENSE_PORTAL_URL=https://www.litesecurity.net

openssl rand -hex 32

4Start the Stack

# Pull the latest images
docker compose -f docker-compose.litegrc.yml pull

# Start all services in the background
docker compose -f docker-compose.litegrc.yml up -d

# Watch the logs
docker compose -f docker-compose.litegrc.yml logs -f

On first boot, the backend automatically creates the database schema, seeds compliance frameworks (SOC 2, ISO 27001, NIST, HIPAA, PCI DSS), and creates a default admin user.

5Verify the Deployment

# Health check
curl http://localhost:8000/health
# Expected: {"status":"ok"}

# Open the frontend
open http://localhost:3000

Configuration Reference

LiteGRC is configured entirely through environment variables. Here are the key settings:

Application

Database

Security

Feature Flags

Data Lifecycle

First Boot & Initial Setup

1. Set the admin password. Provide SEED_ADMIN_PASSWORD (and optionally SEED_ADMIN_EMAIL) in the environment before first boot to choose your own credentials. If you don't set one, LiteGRC generates a strong random password on first boot and prints it once to the backend logs:

   docker compose logs backend | grep generated_password

2. Log in with admin@grc-platform.dev (or your SEED_ADMIN_EMAIL) and that password.
3. Change the admin password immediately via the Settings page.
4. Create your organization (tenant) and invite team members.
5. Activate frameworks — go to Frameworks and enable the ones relevant to your compliance needs.
6. Configure integrations — connect your cloud providers (AWS, Azure, GCP) for automated control testing.

Integrations (Connectors)

Connectors pull evidence and posture automatically, so controls test themselves instead of relying on screenshots. Add them under Integrations → Add integration and supply per-connector credentials (read-only where possible). Supported today:

• Identity & HR — Active Directory, Azure AD / Entra ID, Okta, Google Workspace, M365, Workday, BambooHR.
• Cloud & infra — AWS, Azure, GCP, VMware, Intune, Omnissa.
• Security & vuln — CrowdStrike, Wiz, Snyk, Tenable, Rapid7, StackHawk, Splunk, Datadog.
• Dev & ops — GitHub, Jira, PagerDuty, Slack.
• Business systems — Salesforce, ServiceNow.

Credentials are encrypted at rest; for enterprise secret stores you can back them with Azure Key Vault or CyberArk. Each connector maps its findings onto the controls it satisfies, so one integration lights up controls across every mapped framework.

Frameworks & Control Mapping

LiteGRC ships a catalog of frameworks, seeded on first boot. Enable the ones you need under Frameworks; each carries its full control set with test procedures and evidence requirements.

• Security & privacy — SOC 2, ISO/IEC 27001, NIST CSF, NIST 800-53, NIST 800-171, PCI-DSS, CIS Controls v8, HIPAA, GDPR, CCPA, COPPA.
• Financial & sector — GLBA, FFIEC CAT, NYDFS 500, CRI Profile, CMMC.
• AI governance — NIST AI RMF 1.0, ISO/IEC 42001.

Control mapping ties equivalent controls across frameworks (e.g. SOC 2 CC6.1 ↔ ISO 27001 A.5.15 ↔ NIST CSF PR.AA-01), so a single test result propagates to every mapped control — collect once, comply many. The crosswalk lives on the Controls page.

Platform Features

Honest, coverage-aware compliance verdicts

Every control's verdict is scored per requirement: a control reads Met only when every required kind of evidence is produced by a tool you've actually connected. A connected tool that fails is never hidden by another's pass; tools you don't own aren't counted against you; and a check that collects no usable data can never turn into a green pass. Controls whose objective no integration can see (wireless, physical security, media handling, personnel screening, equipment maintenance) are honestly Manual — evidenced by uploads and attestations, never by unrelated technical checks.

AI evidence review & reconciliation

With an AI key configured (Settings → AI — bring your own key, requests go only to your provider), LiteGRC reads every evidence artifact against the control's objective and returns a verdict with confidence, justification, and gaps. Uploaded documents are analyzed for real — PDF and Word policy documents are text-extracted before review.

Controls → AI Review is the reconciliation queue: anywhere the AI's reading of the evidence disagrees with the rule engine's verdict — a passing check whose evidence doesn't actually support the objective (disputed pass), or passing evidence no check credits — is flagged for a human. The rule verdict is never silently overridden.

Assessments with gated dual sign-off

An assessment completes only through sign-off, and sign-off is unavailable until every applicable control is assessed and every failing control carries a remediation plan. Completion requires two signatures from different users — the first signer cannot countersign — and both signatures are recorded in the audit trail with names and timestamps.

Issues (POA&M) with management response

Failing results open trackable Issues with owner, due date, severity, root cause, and a formal management response(agree / partially agree / disagree plus narrative), stamped with the responder and time — the audit-workflow standard.

Risk register (5×5 + FAIR)

Qualitative risks land on the industry-standard stepped 5×5 heat map (likelihood × impact position determines the Low / Medium / High band; the score orders risks within a band), with AI-assisted risk-to-control mapping. A FAIR lens (ALE = frequency × magnitude) is available for quantitative programs.

Audit trail, application logs & SIEM export

A hash-chained, append-only audit trail records security-relevant actions (logins, changes, sign-offs) under Settings → Audit Log; application WARN/ERROR logs are captured for troubleshooting under Settings → Application Logs. To stream audit events to a SIEM, create a webhook subscribed to the audit.log event (Settings → Webhooks) — deliveries are HMAC-signed.

Evidence handling

Evidence uploads accept JSON, CSV, TXT, PDF, PNG/JPG, and Office documents (.docx, .xlsx, .doc), validated by magic bytes. Connector-collected evidence is stored with SHA-256 integrity hashes. Test-result history is pruned automatically with hard keep-guarantees (newest results per stream and everything inside the evidence-freshness window always survive) — see TEST_RESULTS_RETENTION_DAYS below.

Upgrading LiteGRC

Upgrades are simple — pull the new images and restart. Your license key and data persist across versions.

# Pull the latest images
docker compose -f docker-compose.litegrc.yml pull

# Restart with the new version
docker compose -f docker-compose.litegrc.yml up -d

# Verify
curl http://localhost:8000/health

To pin a specific version:

# In .env
GRC_VERSION=1.2.0

# Then pull + restart
docker compose -f docker-compose.litegrc.yml pull
docker compose -f docker-compose.litegrc.yml up -d

Background Workers (Celery)

LiteGRC uses Celery for scheduled and background tasks. The compose file includes both a worker and a beat scheduler. These run automatically.

Scheduled Tasks

Troubleshooting

License key errors at startup

# Check the backend logs
docker compose -f docker-compose.litegrc.yml logs backend | grep -i license

# Common issues:
# - LICENSE_KEY not set in .env
# - Key has expired (check your dashboard for a new key)
# - Key is for the wrong product (LiteGRC keys start with LS-GRC-)

Database connection errors

# Wait for MySQL to be healthy first
docker compose -f docker-compose.litegrc.yml ps

# Check MySQL logs
docker compose -f docker-compose.litegrc.yml logs mysql

Resetting the admin password

# Connect to the running backend container
docker compose -f docker-compose.litegrc.yml exec backend bash

# Use the built-in password reset
python -m app.scripts.reset_admin_password

LiteAI

LiteAI is an AI security platform. It can run as a Docker container (dashboard + optional HTTPS proxy) or as a CLI tool for scanning and connector management.

Docker Installation

1Authenticate with the Container Registry

docker login ghcr.io -u <your-username> -p <your-registry-token>

2Create Your Environment File

# .env — LiteAI Configuration
# ─────────────────────────────────

# License (required)
LITEAI_LICENSE_KEY=LS-AI-your-license-key-here

# Dashboard authentication (required)
AUTH_USERNAME=admin
AUTH_PASSWORD=your-strong-password

# Optional: API key for programmatic access
API_KEY=your-api-key

# Gateway proxy (set to true to enable HTTPS interception)
PROXY_ENABLED=false
PROXY_HOST=your-proxy-hostname
PROXY_PUBLIC_PORT=18443

# Security policies
APPROVED_PROVIDERS=openai,anthropic,azure-openai,aws-bedrock,google-ai,google-vertex
DLP_ACTION=alert        # redact | block | alert | log
SHADOW_AI_ACTION=alert  # block | alert | log
PROMPT_SECURITY_ACTION=alert  # block | alert | log

# Optional: License portal for heartbeat
LICENSE_PORTAL_URL=https://www.litesecurity.net

3Start LiteAI

# Pull the latest image
docker compose -f docker-compose.liteai.yml pull

# Start
docker compose -f docker-compose.liteai.yml up -d

# Check logs
docker compose -f docker-compose.liteai.yml logs -f

4Verify

# Dashboard
open http://localhost:18080/dashboard

# Health check
curl http://localhost:18080/health

CLI Installation

LiteAI also ships as a Python CLI for scanning, connector management, and gateway control.

1Install with pip

# Requires Python 3.11+
pip install liteai

# With all connectors
pip install "liteai[connectors]"

# With DLP support
pip install "liteai[dlp]"

# Everything
pip install "liteai[connectors,dlp]"

2Set Your License Key

# Option A: Environment variable
export LITEAI_LICENSE_KEY="LS-AI-your-key-here"

# Option B: License file (persists across sessions)
mkdir -p ~/.liteai
echo "LS-AI-your-key-here" > ~/.liteai/license.key

# Option C: Config file
cat > ~/.liteai/config.yaml << 'EOF'
license_key: "LS-AI-your-key-here"
EOF

3Verify Installation

# Check version
liteai version

# List available connectors
liteai connectors list

# Run a scan
liteai scan run --target https://api.openai.com/v1/chat/completions

Gateway Setup

The AI Traffic Gateway is an HTTPS proxy (based on mitmproxy) that intercepts traffic to AI providers. It enables shadow AI detection, DLP scanning, and prompt security enforcement.

Enable the Proxy

# In .env
PROXY_ENABLED=true
PROXY_HOST=your-proxy-hostname    # The hostname clients will use
PROXY_PUBLIC_PORT=18443           # The port clients will connect to

Distribute the CA Certificate

The gateway generates a CA certificate on first boot. Clients need this certificate to trust the proxy.

# Download the CA cert from the dashboard
curl -o liteai-ca.pem http://localhost:18080/ca.pem

# Or copy from the container
docker compose -f docker-compose.liteai.yml cp liteai:/app/data/ca/ca.pem ./liteai-ca.pem

Configure Clients

Point client machines at the proxy using a PAC file (auto-generated) or manual proxy settings:

# PAC file URL (auto-routes AI traffic through the proxy)
http://your-proxy-hostname:18080/proxy.pac

# Manual proxy configuration
export HTTPS_PROXY=https://your-proxy-hostname:18443
export SSL_CERT_FILE=./liteai-ca.pem

Security Policies

AIDR+ Connectors

Connectors discover and inventory AI services across your cloud providers. Available connectors depend on your license tier.

Configuring Connectors

# config.yaml
connectors:
  - connector_type: aws_bedrock
    enabled: true
    credentials:
      aws_access_key_id: AKIA...
      aws_secret_access_key: ...
      region: us-east-1

  - connector_type: azure_ai
    enabled: true
    credentials:
      tenant_id: ...
      client_id: ...
      client_secret: ...
      subscription_id: ...

Platform Features

Two-plane console

The dashboard is organized around LiteAI's two surfaces: AI Monitoring (runtime security — gateway traffic, DLP, shadow AI, agents) and AIDR+ (posture — discovered AI services, configuration findings, policy). A module switcher moves between planes; the Overview combines both with a cross-plane alerts feed, so runtime detections and posture findings land in one queue.

Gateway detection tiers

Tier 1 runs inline on every request: rule-based DLP, shadow-AI detection, and provider policy — enforcement is immediate (DLP_ACTION / SHADOW_AI_ACTION). An optional Tier 2 adds asynchronous ML scanning (a local prompt-injection classifier) that runs off the request path and is alert-only — it can flag but never block or add latency. Tier 2 is off by default and double-gated: build the image with WITH_ML_TIER=true and enable at runtime with LITEAI_ML_TIER. The model runs fully in-process — no data leaves the appliance.

Policy groups with an enforcement ladder

Detection rules are managed in policy groups targeted at populations (everyone, a directory group, specific users). Each group climbs an enforcement ladder — Audit → Block + suggest → Enforce — so you can watch a policy's impact before turning it on. An enforcement preview shows exactly how many rules in a group are blocking, alerting, logging, or disabled.

Approvals (human-in-the-loop)

Flagged activity can be routed to an approvals queue instead of being silently blocked or allowed: reviewers see the detection kind, finding, provider, and user, approve or reject individually or in bulk, and decisions can become standing rules so the same case doesn't come back.

Agent & session monitoring

The Agents plane tracks agentic AI activity with per-session drill-down — the full event trail of a session — plus a risk distribution across agents, models used, and flagged behavior, alongside analytics with headline KPIs and gateway latency percentiles.

Upgrading LiteAI

# Docker
docker compose -f docker-compose.liteai.yml pull
docker compose -f docker-compose.liteai.yml up -d

# CLI
pip install --upgrade liteai

LiteAI Troubleshooting

License errors

# Check which key source is being used
docker compose -f docker-compose.liteai.yml logs | grep -i license

# Verify CLI license
liteai version
# If license is invalid, you'll see the error here

# Common issues:
# - LITEAI_LICENSE_KEY not set
# - Key starts with LS-GRC- (wrong product — use LS-AI- keys)
# - Key has expired

Proxy not intercepting traffic

# Verify proxy is running
curl -x https://localhost:18443 https://api.openai.com/v1/models

# Check PROXY_ENABLED=true in .env
# Verify clients have the CA certificate installed
# Check PAC file is accessible: curl http://localhost:18080/proxy.pac

Configuration — External DB, Domain & TLS

The appliance runs self-contained on the box's volume by default. Point it at your own database and domain by adding these to the same .env.

External database

By default LiteAI stores state in SQLite on the mounted volume. For an external managed database — and for any multi-replica / HA deployment — set DATABASE_URL. It takes priority over the on-box SQLite.

# Postgres (recommended for HA) or MySQL
DATABASE_URL=postgresql+asyncpg://liteai:<password>@db.example.com:5432/liteai

Your own domain over HTTPS

PROXY_HOST is the reachable DNS name of the appliance — it is baked verbatim into the PAC that endpoints receive. Turn on dashboard TLS and mount your certificate to serve the console on your domain:

PROXY_HOST=ai.example.com            # your DNS name (A/CNAME -> the box)
DASHBOARD_TLS=on
DASHBOARD_TLS_CERT=/certs/ai.example.com.crt
DASHBOARD_TLS_KEY=/certs/ai.example.com.key

# mount the certs into the container (docker-compose.liteai.yml):
#   volumes:
#     - ./certs:/certs:ro

Or leave dashboard TLS off (HTTP on :18080) and terminate TLS at an upstream reverse proxy.

Stable secrets

Generate LITEAI_SECRET_KEY (a Fernet key — it encrypts stored credentials and the intercepting CA key) and SESSION_SECRET (session cookies) once and keep them stable — rotating them logs everyone out and orphans encrypted data (including the CA private key).

# LITEAI_SECRET_KEY MUST be a Fernet key, not a hex string:
LITEAI_SECRET_KEY=$(python3 -c 'from cryptography.fernet import Fernet;print(Fernet.generate_key().decode())')
SESSION_SECRET=$(openssl rand -hex 32)

Directory & Endpoint Enrollment

Once the console is up, the day-1 rollout is four steps:

1. Directory → Connect — bind LiteAI to Active Directory over LDAP/LDAPS (base DN + a read-only bind user) so devices and users are known.
2. Discovery — LiteAI surfaces AD-joined and network-discovered endpoints. Group a pilot set.
3. Push the PAC + CA — deploy the proxy auto-config (PAC) and the LiteAI CA certificate to the pilot endpoints (via GPO / MDM). Traffic then routes through the gateway on :18443.
4. Policy Groups — start groups in monitor (audit) mode, then promote to block as you gain confidence.

Deployment Options & High Availability

Docker Compose is the simplest path, but LiteAI also ships for cloud and Kubernetes:

• Helm (Kubernetes) — deploy/helm/liteai.
• Terraform (AWS) — ECS Fargate + RDS Postgres.
• Terraform (Azure) — ACI + Postgres Flexible Server.

Scaling rule: the default SQLite is single-writer, so it is fine at one replica with a volume. For more than one replica (HA), use an external database via DATABASE_URL — the Helm chart refuses to render more than one replica without one.

Environment Variable Reference

LiteGRC

LiteAI

License States

Support

• Email: support@litesecurity.net
• Sales: sales@litesecurity.net
• Enterprise customers: Contact your dedicated account manager directly.

Include your license ID (visible in your dashboard) and product version when contacting support.