Security model

Plexivo is built on the assumption that every request must prove who it is and what it may do. This page explains the layers; the Security page has the overview.

Isolation between customers#

Each customer’s apps, databases and caches have their own network boundary; another customer’s workloads cannot reach them. Every request is checked against your organisation and the member or key making it, and an API key works only for the organisation it was issued for. A Plexivo Kubernetes kubeconfig reaches only your own namespace.

Who can do what#

• Roles. Owner, Admin and Member decide what each person can do. Only owners manage billing, unless a policy grants it. See Members and roles.
• Approval before change. Plexivo AI changes nothing until an owner or admin approves its plan and price.
• API keys with scopes. A key can read, write, delete or touch billing only if you gave it that scope, and a key can never manage members, access or other keys. Keys can expire and have their own request limits.
• CLI sessions that expire. Each CLI sign-in is approved in the browser, limited to the access you choose, and ends on its own. See Install the CLI.
• Support access only with your approval. When Plexivo support needs to look inside your organisation for a ticket, it asks for a set time, read only by default or read and write. An owner approves; owners and admins can deny it or end it at any time, and are emailed at every step. Emergency access needs a written reason, emails your owners and admins at once, and is listed with everything done under it. See Support access.

Signing in#

• Passwords are at least 12 characters. Each account accepts only a limited number of wrong passwords in a short time, from any network.
• Two-step verification with an authenticator app is available to everyone, with one-time recovery codes. It is optional; we recommend it for owners and admins.
• Console sessions end after a period without activity and after a maximum length, both set by your organisation’s owner. See Sessions.

Protected connections#

• The console, the API and your apps’ public addresses use HTTPS.
• Databases and caches accept TLS connections, and each cache has its own certificate authority, so your client can verify exactly the cache it reaches.
• You choose who can reach each database: public with TLS, only trusted IP addresses, or private to your project and reachable from your laptop through a CLI tunnel.

Secrets#

Plexivo Secrets stores keys and passwords encrypted and gives them to your apps when they run. Lists show fingerprints, never values. Revealing a value needs the owner or admin role, and every reveal is recorded.

Audit log#

Every change in your organisation is recorded: who did it, from which network, and what changed, with secrets removed. Refused attempts are recorded too, and so is any access by Plexivo support or a partner managing your account. The log cannot be edited or deleted. Find it in Settings → Audit log.

Who looks after what#

Report a security issue#

Tell us what you found and how to reproduce it at security@plexivo.io. Please do not include passwords, secret keys or customer data.