Secure

Weik.io 2026.2

Give people and keys access through projects, roles and grants, sign in with single sign-on and two-factor sign-in, seal secrets, read the audit log, open break-glass access, allow networks and keep integrations apart.

These pages are for the administrator who decides who may do what in Weik.io, and for the security reviewer who checks it. People sign in through Microsoft Entra ID or any OpenID Connect provider, or with a local account and two-factor sign-in. A grant gives a person or an API key a role in a project, down to single environments, integrations or APIs, and every route of the API refuses what no grant allows.

Every change made through the API, the weikio CLI, a GitOps apply or the admin UI gets an audit record. The hub keeps the audit trail for 400 days, and telemetry forwarding sends it to your SIEM. Secret values are sealed with AES-256-GCM under the installation’s master key, and revealing a value is a permission of its own. The platform can also get secrets from Azure Key Vault or HashiCorp Vault through a Dapr sidecar.

The hub publishes only port 443, and the sites connect out to it without opening an inbound port. An agent reaches only the projects and environments an administrator allowed it, and every build at the hub runs isolated with Landlock.

The product page Security gives the whole trust model in one place.

Pages#

Projects and access A project groups integrations, APIs and their values, and a grant gives a person a role in a project, down to single environments, integrations or APIs.Sign-in and providers People sign in to the admin UI through Microsoft Entra ID, another OpenID Connect provider or a local account, and claim mappings turn a provider's app roles or groups into grants.Two-factor sign-in Platform administrators and emergency accounts give a code from an authenticator app at every local sign-in, and ten recovery codes cover a lost phone.Roles and grants Four roles ship with Weik.io, and a custom role is a document that lists its own verbs.API keys An API key signs in the weikio CLI or a pipeline with its own grants and expiry, and it never has more rights than the person it belongs to.Secrets Secret values are sealed with AES-256-GCM under the installation's master key, and the platform can also get them from Azure Key Vault or HashiCorp Vault through a Dapr sidecar.Audit log Every change made through the API, the weikio CLI, GitOps or the admin UI gets an audit record with its diff and who made it, and the trail is kept for 400 days.Break-glass access Emergency accounts sign in only while a break-glass window opened on the hub's host is open, and the audit log records every request they make.Allowed networks and TLS The hub can admit only the address ranges you list, and its one published port accepts only TLS 1.2 and 1.3 with AEAD cipher suites.Keeping integrations apart Integrations that must not see each other's data run on agents with different allowed projects, and every build at the hub runs isolated with Landlock.