# Security model

> What Fransys protects by default, what you set yourself, and the airlock between your agent and your infrastructure.

Source: https://docs.fransys.cloud/en/securite/modele-de-securite/ Checked against the console on 2026-10-23.

## By default, with nothing to set

- **HTTPS everywhere**: every public address has its certificate, generated and renewed on its own, for the `fransysapp.com` address as well as for your domains.
- **Internal services**: a service without access from the internet can only be reached by the services in its project. Databases have no public address until you turn on remote access.
- **Isolated projects**: a project's services can't see those of other projects on the same cluster; they only communicate through the links you draw.
- **Generated credentials**: database passwords are created by Fransys and passed to linked services through their variables. No default passwords.
- **Automatic rollback**: a failed deployment is undone, and the previous version stays online.

## Secrets

- **Protected variables**: the value is encrypted and can't be read afterwards, not even by you. It doesn't appear in the `.env` export or in plans (it's masked there).
- **Private registry**: the registry password is encrypted, like a protected variable.
- **Cloud accounts**: Fransys checks the key with the hosting provider, then never shows it again.
- **Payment**: you enter your card or bank account with Stripe; Fransys never sees the numbers.

## Agents go through an airlock

- An agent key only grants read access.
- The agent prepares plans; it has no tool to approve or run them. A person on your team approves each plan in the console.
- The activity log keeps track of who did what, person or agent key.
- Removing a key cuts the agent's access right away.

See [What an agent can do](https://docs.fransys.cloud/en/agents/ce-qu-un-agent-peut-faire/).

## What you can harden

In an application's panel, **Security** and **Advanced** tabs:
- **Run as non-root**, with the **Run as user** and **Run as group**;
- **Allow privilege escalation**: turn it off if your application doesn't need it;
- **Drop Linux capabilities**;
- the **Seccomp profile**;
- the **Kubernetes service account** and its rules, if your application talks to the Kubernetes API.

## What remains your responsibility

- No secrets in the code or in the image: use protected variables.
- Remote access to a database opened only for as long as you need it.
- Two-factor authentication on your account. See [Account security](https://docs.fransys.cloud/en/compte/securite-du-compte/).
- Named agent keys, one per agent or per person, removed when no longer used.