Product · Security
What an IT lead reads first
Every statement on this page is one the product's own tests hold true. What is not encrypted is said as plainly as what is.
Tenants and environments are sealed off
Every tenant is fully isolated; every environment of a tenant is isolated from its sibling. Nothing reaches the other except a promotion a person performs. A grant is visibility: what you are not granted answers not found, not forbidden.
People and access in the docs →A secret is entered once and never comes back
A credential is entered once, encrypted at rest, and bound to its tenant, environment, entity and field; ciphertext copied from elsewhere does not open. No screen, command, diff or recorded request returns a value, and the part of the platform you author in has no path that reads a secret back. A promotion carries no credential; the target keeps its own.
Tokens are narrow and short
A token names one tenant and one environment when it is minted and always expires — after14 days at most by default. It cannot change connections or other credential-bearing entities unless minted with that permission, and it can never mint a successor with more rights than itself. Debug, step and probe exist only in a sandbox.
Sign-in
Password and a second factor (TOTP with recovery codes), required for allaccounts in a production deployment by default, with a lockout on both factors and an administrator reset for a lost factor. A browser session ends after30 minutes idle or 12 hours absolute. There is no default administrator: the first account is created from a one-time setup token.
Where your calls may go, and who may call you
Cloud metadata addresses are refused always; private address space is denied unless a tenant admin allows ranges; every socket is judged at connect and pinned to the judged address. Every call carries a User-Agent naming the platform, from an outbound address your operator configured and reports. Inbound, an endpoint lists the networks it accepts, verifies each sender's signature from recorded vectors, drops a repeated delivery, and answers a registration handshake without running anything.
Limits and safety in the docs →Two trails that show if they were edited
Both audit trails are append-only and hash-chained: a changed or removed row is detectable. Policy switches are recorded at the moment they change, with who changed them. The trail is kept 365 days on the running side and never deleted by age on the authoring side.
What is not encrypted
Registered secrets are encrypted at rest. Scripts, configuration, run records and datasets are stored in plain form on the volume — encrypting the disk is the operator's job, and the installation guide names it as a precondition for production.
Leaving, and how it is built
Deleting a tenant removes configuration, history, credentials, runs, files and staged data on every machine, and is reported finished only when every machine has confirmed; the audit trail survives. Builds are security-scanned: dependency audit, secret scan, static analysis, a software bill of materials and an image scan.
Every sentence about security →