Security
Weik.io protects your integrations and data with single sign-on, grants that can limit a person to one integration, secrets sealed with AES-256-GCM and an audit log that keeps every change for 400 days. People sign in through Microsoft Entra ID or any OpenID Connect provider, and telemetry forwarding sends the audit trail to your own SIEM.
The trust model
Agents open no inbound port. Each agent connects out to the hub on port 443, and the hub publishes port 443 only, with TLS 1.2 and 1.3. Secrets are sealed with AES-256-GCM under a master key kept on the host. The audit stream can't be deleted or shortened with the backend's own credentials. An agent's credential reaches only the projects and environments an admin allowed for it, such as finance in production.
- The hub publishes port 443 only, with TLS 1.2 and 1.3.
- Secrets are sealed with AES-256-GCM under a master key kept on the host, outside the store and outside every backup.
- The audit stream can't be deleted or shortened with the backend's own credentials.
- An agent's credential reaches only the projects and environments an admin allowed for it.
Controls
Identity and access
| Control | What it does |
|---|---|
| Single sign-on | Microsoft Entra ID and any OpenID Connect provider, with one button per provider on the sign-in page |
| Claim mappings | A provider's group claim becomes grants in Weik.io, so access follows your directory |
| Two-factor sign-in | An authenticator app with ten recovery codes, required of platform administrators. Weik.io raises a problem while it is switched off. |
| Local accounts | Limited to emergency use once single sign-on works, with passwords stored as PBKDF2-SHA256 with 600,000 iterations |
| Roles | Viewer, editor, deployer and admin, and custom roles made of the verbs you choose |
| Grants | A role on a project in the environments you choose, down to one integration or API, with every request denied unless a grant allows it |
| API keys | Created with grants and an expiry, never wider than their owner's own grants, and shown once |
Docs: Sign-in and providers · Roles and grants · Two-factor sign-in · API keys
weikio member add line that does the same.Data protection
| Control | What it does |
|---|---|
| Sealed secrets | AES-256-GCM under a master key kept in a file on each backend host and never in a backup |
| Revealing a secret | A permission of its own that can be switched off per environment, and every reveal is audited |
| External secrets | A Dapr secrets sidecar fetches secrets from Azure Key Vault, HashiCorp Vault and the other stores Dapr supports |
| Sealed backups | Every backup archive is sealed before it leaves the hub |
| Immutable backup copies | S3 Object Lock in compliance mode, so no key, the hub's own included, can delete a copy early |
| Disk encryption | The hub's disks are encrypted by your cloud provider or with LUKS2, with step-by-step guides for Hetzner and bare metal |
Docs: Secrets · Encryption at rest
Network
| Control | What it does |
|---|---|
| Outbound-only agents | An agent connects out to the hub on port 443 and opens no inbound port |
| Allowed networks | The hub can admit only the address ranges you list |
| Gateways | Each gateway lists the networks it admits and its client certificate policy, none, optional or required, with the authorities it trusts |
| TLS | Port 443 only, TLS 1.2 and 1.3, and only AEAD suites on TLS 1.2 |
| Certificates | Obtained and renewed by the platform for the hub's names and every gateway hostname |
| Subscription keys | An API key is shown once and stored only as a hash, and each subscription has its own rate limit and expiry date |
| Sessions | The admin UI's session cookie uses the __Host- prefix, and the admin UI is served from the same origin as the API, so no CORS is needed |
Docs: Allowed networks and TLS · Network
Audit and monitoring
| Control | What it does |
|---|---|
| Every change | Each change through the API, the CLI, a GitOps apply or the admin UI writes a record with its diff, actor, reason and commit |
| More than changes | Sign-ins, secret reveals, enrolments, revocations, break-glass access, backups, restores and every read of the audit itself are recorded too |
| Retention | The audit log is kept 400 days and can be forwarded to your SIEM |
| A trail that stays | The audit stream can't be deleted or shortened with the backend's own credentials |
Docs: Audit log · Telemetry forwarding
weikio audit query line above the filters runs the same search.Emergency access
| Control | What it does |
|---|---|
| Break-glass accounts | Sign in only while a window opened on the hub host is open, for 1 to 72 hours, from the addresses the window lists |
| When everything else is down | The break-glass commands run on the hub host and work while every backend is down, and every request is audited and can be posted to a webhook |
Docs: Break-glass access
Supply chain and builds
| Control | What it does |
|---|---|
| Exact images | images.env lists every image of a release with its tag and digest, and no image is tagged latest |
| Licences | Every image contains its licence, notice and third-party notices, and these are checked before each release is published |
| Checksums | The installer and the install scripts check SHA256SUMS before they use a file |
| Signed Windows files | Adafy Oy signs the Windows CLI with Authenticode and a timestamp, and it signs the agent installer for Windows Server too |
| Isolated builds | Builds run with Landlock on Linux 6.7 and later, which limits what a build can read, write and connect to |
| Token keys | The backend signs tokens with ES256 keys that are stored sealed and rotated every 90 days |
Report a vulnerability
Write to security@weik.io or use GitHub's private vulnerability reporting on weikio/weikio, with the release, the steps to reproduce and what you saw.
The policy is in SECURITY.md on GitHub and in /.well-known/security.txt. Fixes ship as patch releases, and the release notes of the fixing release describe them.
Weik.io Cloud
Weik.io Cloud is operated by Adafy Oy under Finnish law, and its servers run in Hetzner's data centre park in Helsinki. The park is ISO/IEC 27001 certified, and the certificate belongs to the data centre operator, Hetzner Online GmbH. The sovereignty page of weikio.cloud links the data processing agreement and the list of subprocessors.
Questions
Where is my data stored?
Everything a self-hosted Weik.io stores stays in your installation. How Weik.io is put together lists where each kind of data lives and for how long.
Who can read secret values?
Only people whose role has the reveal permission in that environment can read them, and every reveal is audited. An environment such as production can switch reveals off for everyone.
Can Adafy's staff reach my installation?
They have no access to a self-hosted installation. When you create an account for them during a support case, your audit log shows everything they do with it.
How do I hear about security fixes?
Watch releases on GitHub or follow the releases feed. A support agreement can include security advisories before publication.
Book a demo
Bring your security questions to the demo, and an engineer from the Weik.io team answers them.