Alpha security model

Security

Boundaries your platform team can inspect

Rollout coordinates credentials, workflow code, operators, and business records. The useful security question is not whether those things exist; it is where each boundary is enforced, what evidence remains, and which guarantees belong to the hosted service versus your own deployment.

  1. 01

    Scope

    Resolve the actor and workspace before a protected row can leave the database.

  2. 02

    Capability

    Share Connections, secrets, devices, and volumes deliberately — private by default.

  3. 03

    Runtime

    Execute untrusted cloud steps in ephemeral, restricted, gVisor-sandboxed pods.

  4. 04

    Evidence

    Redact before persistence and broadcast; retain actor, action, outcome, and time.

Implemented controls

Controls you can inspect

Each claim links to the longer public contract. Those contracts describe the code path and the limits, not a certification badge.
Workspace isolation Shipped

Tenant scope lives in the query

Protected reads carry a workspace identity and apply access checks before rows are hydrated. Switching workspaces means switching datasets, not filtering a shared page.

Sharing and permissions →
Credentials Shipped

Write-only, envelope-encrypted secrets

Secrets use AES-256-GCM under an envelope data key. Hosted Rollout keeps the wrapping key in Cloud KMS; self-hosted deployments supply their configured master key.

Secret handling →
Code isolation Cloud

Ephemeral gVisor runner pods

Cloud code steps run in tenant namespaces with restricted pod security, dropped Linux capabilities, resource limits, and policy-controlled HTTPS egress.

Security overview →
Run output Fail closed

No registry answer means no raw strings

Injected credentials are scrubbed from step inputs, outputs, errors, final results, and live chunks before storage or broadcast. An unavailable registry suppresses strings.

Workflow security →
Operator evidence Append only

Sensitive actions leave a receipt

Secret access records actor, action, outcome, and timestamp without the value. Hosted deployments also copy secret-audit events to the observability pipeline.

Audit-log contract →
Web boundary Production

Nonce-based CSP and hardened sessions

Production enforces HTTPS and HSTS; forms use CSRF protection; login renews the session; and inline scripts require a per-request Content-Security-Policy nonce.

Authentication and web security →

Deployment boundary

Managed Cloud and self-hosted are not the same promise

Managed Cloud

Rollout operates the boundary

Workflow code runs in ephemeral gVisor pods inside tenant namespaces. Hosted secret envelopes use a Cloud KMS wrapping key, and the service operates the database, network policy, observability path, and runner lifecycle.

Self-hosted

The operator owns the boundary

You choose the cluster, runtime class, namespaces, network policy, database, and key provider. A self-hosted operator can change or disable those infrastructure controls, so the hosted isolation claim does not transfer automatically.

Limits

What this page does not claim

  • Rollout is in alpha; security behavior can change with the product.
  • No compliance certification is claimed on this page.
  • Self-hosted operators own the security of their cluster, network, database, and key provider.
  • Output redaction covers credentials the engine injected and their Base64 forms — not arbitrary encodings or data a workflow sends to an external service.

Read the full security overview and secret-handling contract.

Review your boundary with the people building it

Bring your threat model and deployment constraints. We will tell you which controls exist, which ones you own, and where the alpha still has gaps.

Prefer to talk it through? Talk to the founder