# Security posture

> A distroless, non-root, multi-architecture image; SBOM, keyless signature and attestation on the digest; a release re-tags the tested digest, never rebuilds

Concept - Since version 0.1.0 - Flexway v1.6.3 - https://flexway.io/en/docs/product-security/

> Product guide: what the capability brings, for whom, its limits and the version that delivered it - no configuration syntax.
>
> Developer side: [Getting credentials](https://flexway.io/en/docs/developer-credentials/); operations side: [Wiring your identity provider](https://flexway.io/en/docs/operations-identity/), [Moving to Kubernetes](https://flexway.io/en/docs/operations-kubernetes/).

| Area | What is done |
| --- | --- |
| **Supply chain** | A distroless, non-root, multi-architecture image; SBOM, keyless signature and attestation **on the digest**; a release re-tags the tested digest, never rebuilds |
| **Secrets** | Always by reference (a variable or a mounted file), never in clear in the configuration - a clear value refuses the load |
| **Request path** | Closed by default; parameters and body validated against the contract; no internal upstream error relayed; security headers on every response |
| **Personal data** | Zero PII in logs; the subject hashed in the audit and the counters; no AI prompt logged |
| **Proven rules** | The `RG-*` business rules are tested exit criteria, not intentions; an internal security review of authentication and isolation before `1.0.0` |
| **AI** | No model decides an authorization, a rate or a route: AI proposes, the configuration disposes |
| **Limits** | No external security audit to date; no WAF or anti-DDoS (the edge's job); the exportable execution proof for the EU AI Act comes in `1.9.0` |

Operations detail: [Moving to Kubernetes](https://flexway.io/en/docs/operations-kubernetes/).