Today we are releasing a major expansion of the Apeiro Reference Architecture Documentation: a comprehensive Security section.

Apeiro integrates security throughout its architecture, grounded in open standards and open-source components. The new section documents how these components fit together across the full defense-in-depth stack, and clearly distinguishes what Apeiro provides from what platform operators are responsible for.

New Security Documentation Pages:

• Security Principles: Zero Trust, digital sovereignty, open standards, and the defense-in-depth layering model that structures the entire section.
• Scope and Shared Responsibility: A clear breakdown of what Apeiro provides versus what operators own - from network configuration to HSM procurement and AI security policy.
• Network Security: IronCore declarative networking and tenant isolation, CobaltCore for traditional workloads, and the in-development Zero Trust Workload Identities for mTLS.
• Identity and Access Management: Authentication via Keycloak and OIDC, Relationship-Based Access Control with OpenFGA, and workload identity federation.
• Secrets Management and PKI: OpenBao for secrets storage, certificate lifecycle management, and PKI.
• Key Management: OpenKCM for customer-controlled encryption at rest, BYOK/HYOK support, and pluggable KMS backends.
• Software Supply Chain Security: Open Component Model for provenance and signing, Open Delivery Gear for continuous compliance scanning, and Konfidence for SaaS application delivery governance.
• Security Operations: Greenhouse-based observability, Heureka for security posture management, audit logging, and incident response integration points.
• Emerging Threats: Open Crypto Broker for algorithm governance, post-quantum migration path, and continuous vulnerability visibility - including AI-driven threats and agent credential risks.

Whether you are a platform operator evaluating Apeiro's security posture, an architect integrating its components, or a compliance team mapping responsibilities, the new section gives you a structured, factual starting point.

Explore the Security section in the Apeiro Reference Architecture Documentation!