Security model

Nothing reaches in: your cluster pulls, verifies with keys you pin, and promotes to production on your attestation. Everything of ours that executes there is a readable shell or Python script, Apache-2.0 like the rest, and each one is named below with what switches it on. Nothing proprietary runs at all.

Ours, in your cluster	On when	What it does
The PreSync verifier — a shell script on Alpine with cosign, oras and jq	only with `--verifier-image`; off otherwise	reads the channel and its own policy, writes nothing
The station floor check, on the station-bundle path	`floor.enabled`, which the chart ships true, every 10 minutes	reads Argo Applications, nodes and volumes, and writes one ConfigMap in the argocd namespace with its verdict — the only thing of ours that writes
The T1 receipt sender and its cadenced sibling, on the station-bundle path	`receiptSender.enabled`, which the chart ships false	the one component of ours that reaches outward, and only to the channel host you already pull from — what it may carry

Component	Controlled by
Argo CD, Kyverno — stock upstream, pinned	You: your reconciler, your admission layer
The admission policy: one file, two ClusterPolicies — digest-pinning, signature verification	You — tighten at will
The subscription: one ApplicationSet, including the production pin	You
Preflight, smoke, validate — readable scripts on your operator’s machine	You
The kit — cloned from the public repository, or pulled as a signed artifact and verified against your key before unpacking	You, including when to update
The Vexa workloads — digest-pinned images	Admitted only by your policy

This is an open-source collaboration: Vexa, the delivery machinery, and everything that will ever travel through the channel is Apache-2.0. Both paths run the same software.

What leaves your cluster

Nothing is required to leave. The subscription pulls and sends nothing, verification is offline, and blocking all egress only makes updates wait. Meeting content — audio, transcripts, participants — is in no delivery, verification or support payload. Three outbound classes exist, each off by default and each something your side chooses to send:

Class	Carries
Support tickets	Composed locally, shown in full before sending: configuration shapes and error records
The station report	One file, written to disk and sent by hand: substrate facts, values with secrets replaced, the contract, the receipts. You read all of it first — that is what one file is for
Notifications and usage reports	Enabled per event class; aggregate numbers and shapes

What each rung may carry, and the three independent things that hold it there, are in the telemetry ladder.

Isolated networks

With no route to channel.vexa.ai, mirror the artifacts into your own registry; digests and signatures survive mirroring, and verification pins our key, not a hostname.

Rung. The mirrored path is proven through a credentialed Harbor pull-through proxy. An install on a genuinely disconnected network has not been exercised yet.

What you pin, and what you hold

You pin the channel verification key, the build platform identity (Sigstore, public repo + issuer), and digest-only image references — so compromise of any registry, ours or your mirror, runs nothing in your cluster. How to check each one. Your credential is pull-only, scoped to your channel, revocable independently of every other subscriber’s inside a minute, enforced at the edge proxy rather than by the registry (why). It reaches you age-encrypted to a key you already control, never in plaintext, on a different route from the public key it pairs with. Vexa holds no credential of yours — there is no inbound access to grant. Preflight reports, before install, exactly which workloads OpenShift SCC restricted-v2 or PodSecurity restricted would refuse. Next: Verify · Telemetry ladder · For your auditors

Start

1 · Install

2 · Subscribe to the channel

3 · It updates itself

Reference

Not yet published

What leaves your cluster

Isolated networks

What you pin, and what you hold

​What leaves your cluster

​Isolated networks

​What you pin, and what you hold

What leaves your cluster

Isolated networks

What you pin, and what you hold