Our security posture, stated precisely.
This page lists what is true today. Every line on it is meant to survive being checked.
One request, end to end
One way in. Your identity all the way through.
Access
Nothing reaches an app without an identity.
Zero-trust access with the Weaver gate
Every request to an app passes the Weaver gate first. It checks who the person is and whether they may use this app before anything reaches it. Removing someone’s access takes effect at once.
No public ingress
Applications are reachable only over encrypted tunnels. There is no public endpoint to discover or probe.
Enterprise SSO on every application
Sign-in federates with your identity provider, so access follows your joiners-and-leavers process.
Data
Separate for each app, and running where you need it.
Per-application data isolation
Each application has its own database, authentication and storage, separated by network-policy boundaries.
Encrypted at rest on dedicated clusters
On a dedicated cluster, all storage and system disks are encrypted, and off-site backups are encrypted before they leave, with the key held outside the cluster.
Dedicated European infrastructure
By default, applications and their data run on dedicated infrastructure located in Europe.
Production in your own cluster (BYOC)
Production apps can run in your own Kubernetes cluster, set up together with us, so their data stays in your environment. Weaver keeps running the platform that builds and manages them.
Code
Every change traced. Every running app scanned.
Full traceability of changes
Every change reaches production through a pull request with a running environment attached. You can see who or which AI agent made it, and when.
Central secret management
Credentials come from a central vault at deploy time and are never committed to your repository.
Hardened workloads
Application containers run as non-root, with privilege escalation blocked and all capabilities dropped.
Continuous scanning
Every running application is scanned daily for vulnerable dependencies and code flaws. Before going live, the exact version is scanned and a failed scan blocks it.
AI
Every AI request has an owner. IT sets the limits.
AI usage audit trail and cost control
Every AI request is attributable to an application and a person. IT sets budgets, gets alerts on spend and chooses which AI models apps may use.