Security architecture
Isolation by design, with an evidence trail for every change.
FlowKeyOps protects credentials, limits tenant blast radius, and continuously reconciles the managed platform behind each workspace.
Bounded shared and private security cells
Dedicated tenant resources inside explicit security boundaries.
Each customer receives dedicated application resources within an isolated namespace. Shared cells have hard tenant capacity limits; Team and Custom plans add a single-tenant private cell.
- Dedicated namespace, repository, vault, database, and storage
- Environment-scoped, write-only secret operations
- Tenant-specific service accounts and role-based access
- Default-deny ingress and egress policies
- Pod Security Admission and restricted workloads
- Short-lived, tenant-bounded deployment credentials
- Signed release artifacts and software bills of materials
- Encrypted, monitored backups with repeatable restore operations
security cell
│
├── tenant namespace
│ ├── repository
│ ├── vault
│ ├── database
│ └── persistent storage
│
├── default-deny network policy
├── tenant-scoped access
└── continuously reconciled state
│
├── tenant namespace
│ ├── repository
│ ├── vault
│ ├── database
│ └── persistent storage
│
├── default-deny network policy
├── tenant-scoped access
└── continuously reconciled state
Transparent threat model: Free and Individual use bounded shared security cells with tenant-level isolation. Team and Custom use a single-tenant private security cell for organizations that require no shared customer workloads within their cell.
Short-lived access
Automation uses short-lived credentials instead of distributing permanent cluster-admin access.
Tenant-bounded deployment access
Tenant identities are limited to the namespace and resource operations required for controlled deployment and recovery.
Continuously reconciled infrastructure
Managed platform services are compared with approved configuration and reconciled when infrastructure drifts.