Security model

What Fransys protects by default, what you set yourself, and the airlock between your agent and your infrastructure.

Checked against the console on 23 Oct 2026

By default, with nothing to set

HTTPS everywhere: every public address has its certificate, generated and renewed on its own, for the fransysapp.com address as well as for your domains.
Internal services: a service without access from the internet can only be reached by the services in its project. Databases have no public address until you turn on remote access.
Isolated projects: a project’s services can’t see those of other projects on the same cluster; they only communicate through the links you draw.
Generated credentials: database passwords are created by Fransys and passed to linked services through their variables. No default passwords.
Automatic rollback: a failed deployment is undone, and the previous version stays online.

Protected variables: the value is encrypted and can’t be read afterwards, not even by you. It doesn’t appear in the .env export or in plans (it’s masked there).
Private registry: the registry password is encrypted, like a protected variable.
Cloud accounts: Fransys checks the key with the hosting provider, then never shows it again.
Payment: you enter your card or bank account with Stripe; Fransys never sees the numbers.

An agent key only grants read access.
The agent prepares plans; it has no tool to approve or run them. A person on your team approves each plan in the console.
The activity log keeps track of who did what, person or agent key.
Removing a key cuts the agent’s access right away.

In an application’s panel, Security and Advanced tabs:

Run as non-root, with the Run as user and Run as group;
Allow privilege escalation: turn it off if your application doesn’t need it;
Drop Linux capabilities;
the Seccomp profile;
the Kubernetes service account and its rules, if your application talks to the Kubernetes API.