> ## Documentation Index
> Fetch the complete documentation index at: https://delivery.vexa.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Security model

> What runs where, what leaves your cluster, and what you pin.

**Nothing reaches in: your cluster pulls, verifies with keys you pin, and promotes to production on your attestation.** Everything of ours that executes there is a readable shell or Python script, Apache-2.0 like the rest, and each one is named below with what switches it on. Nothing proprietary runs at all.

| Ours, in your cluster                                                              | On when                                                                   | What it does                                                                                                                                       |
| ---------------------------------------------------------------------------------- | ------------------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------- |
| The PreSync [verifier](verify) — a shell script on Alpine with cosign, oras and jq | only with [`--verifier-image`](install#step-3-install); **off** otherwise | reads the channel and its own policy, writes nothing                                                                                               |
| The **station floor** check, on the station-bundle path                            | `floor.enabled`, which the chart ships **true**, every 10 minutes         | reads Argo Applications, nodes and volumes, and writes one ConfigMap in the argocd namespace with its verdict — the only thing of ours that writes |
| The **T1 receipt sender** and its cadenced sibling, on the station-bundle path     | `receiptSender.enabled`, which the chart ships **false**                  | the one component of ours that reaches outward, and only to the channel host you already pull from — [what it may carry](telemetry-ladder)         |

| Component                                                                                                                  | Controlled by                              |
| -------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------ |
| Argo CD, Kyverno — stock upstream, pinned                                                                                  | You: your reconciler, your admission layer |
| The admission policy: one file, two ClusterPolicies — digest-pinning, signature verification                               | You — tighten at will                      |
| The subscription: one ApplicationSet, including the production pin                                                         | You                                        |
| Preflight, smoke, validate — readable scripts on your operator's machine                                                   | You                                        |
| The kit — cloned from the public repository, or pulled as a signed artifact and verified against your key before unpacking | You, including when to update              |
| The Vexa workloads — digest-pinned images                                                                                  | Admitted only by your policy               |

This is an open-source collaboration: Vexa, the delivery machinery, and everything that will ever travel through the channel is Apache-2.0. [Both paths](how-it-works) run the same software.

## What leaves your cluster

Nothing is required to leave. The subscription pulls and sends nothing, verification is offline, and blocking all egress only makes updates wait. Meeting content — audio, transcripts, participants — is in no delivery, verification or support payload. Three outbound classes exist, each off by default and each something your side chooses to send:

| Class                                                             | Carries                                                                                                                                                                        |
| ----------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
| [Support tickets](support)                                        | Composed locally, shown in full before sending: configuration shapes and error records                                                                                         |
| [The station report](install#step-5-send-the-station-report-back) | One file, written to disk and sent by hand: substrate facts, values with secrets replaced, the contract, the receipts. You read all of it first — that is what one file is for |
| [Notifications and usage reports](support)                        | Enabled per event class; aggregate numbers and shapes                                                                                                                          |

What each rung may carry, and the three independent things that hold it there, are in the [telemetry ladder](telemetry-ladder).

## Isolated networks

With no route to `channel.vexa.ai`, mirror the artifacts into your own registry; digests and signatures survive mirroring, and verification pins our key, not a hostname.

<Note>
  **Rung.** The mirrored path is proven through a credentialed Harbor pull-through proxy. An install on a **genuinely disconnected** network has not been exercised yet.
</Note>

## What you pin, and what you hold

You pin the channel verification key, the build platform identity (Sigstore, public repo + issuer), and digest-only image references — so compromise of any registry, ours or your mirror, runs nothing in your cluster. [How to check each one](verify).

Your credential is **pull-only**, scoped to your channel, revocable independently of every other subscriber's inside a minute, enforced at the edge proxy rather than by the registry ([why](channel#worth-knowing)). It reaches you age-encrypted to a key you already control, never in plaintext, on a different route from the public key it pairs with. **Vexa holds no credential of yours** — there is no inbound access to grant.

[Preflight](preflight) reports, before install, exactly which workloads OpenShift SCC `restricted-v2` or PodSecurity `restricted` would refuse.

Next: [Verify](verify) · [Telemetry ladder](telemetry-ladder) · [For your auditors](governance)