Security Principles
Apeiro's security architecture is shaped by a set of principles that inform component selection, integration design, and the boundaries of what the platform defines versus what operators own.
Digital Sovereignty
Apeiro is designed so that organizations retain ownership of their cryptographic material regardless of the underlying infrastructure provider.
- Key ownership: OpenKCM supports BYOK (Bring Your Own Key) and HYOK (Hold Your Own Key), giving organizations direct control over root keys across infrastructure providers and with HSM-backing.
- Own trust root: OpenBao lets organizations operate their own certificate authority and PKI, so certificate trust is rooted in infrastructure the organization controls.
Open Standards
Apeiro uses the following open standards to ensure interoperability:
| Domain | Standards |
|---|---|
| Authentication | OIDC, OAuth2, SPIFFE |
| Transport security | mTLS |
| Observability & audit | OpenTelemetry |
| Software delivery | Open Component Model, SBOM |
Zero Trust
Trust is established through verified identities and cryptographic controls, not network location. Workload-to-workload communication is designed around cryptographically verifiable workload identity based on the SPIFFE standard, enabling mutual TLS between services, implemented by Zero Trust Workload Identities.
Least Privilege
Access decisions in Apeiro are derived from explicit, fine-grained relationships rather than broad static roles. OpenFGA implements Relationship-Based Access Control (ReBAC): permissions are resolved from tuples that describe who has what relationship to which resource. This supports delegated administration, tenant-specific access, and cross-provider authorization without overprivileged service accounts or flat role structures.
Defense in Depth
Security controls are layered across the stack. No single component is the sole line of defense:
- Infrastructure networking isolation: IronCore declarative network resources
- Workload identity, mTLS, and fine-grained authorization: Zero Trust Workload Identities (in development), OpenFGA
- Secrets and certificate lifecycle: OpenBao
- Encryption key governance: OpenKCM
- Software supply chain integrity: Open Component Model, Open Delivery Gear
- Observability and audit logging: Greenhouse, OpenTelemetry
- Crypto agility: Open Crypto Broker