> ## Documentation Index
> Fetch the complete documentation index at: https://docs.hexr.dev/llms.txt
> Use this file to discover all available pages before exploring further.

# Security Overview

> Hexr's defense-in-depth security model — cryptographic identity, policy enforcement, and GenAI threat protection.

## Security Principles

Hexr is built on three security principles:

1. **Identity-first** — every process has a cryptographic SPIFFE identity
2. **Zero standing access** — credentials are short-lived and scoped
3. **Defense-in-depth** — multiple layers, no single point of failure

***

## Security Layers

<AccordionGroup>
  <Accordion title="Layer 1: Identity" icon="fingerprint">
    **SPIFFE/SPIRE** — Every process gets a unique X.509 SVID. Per-process identity, not just per-pod.
  </Accordion>

  <Accordion title="Layer 2: Transport" icon="lock">
    **Envoy mTLS** — All inter-service traffic is encrypted with mutual TLS using SPIFFE certificates.
  </Accordion>

  <Accordion title="Layer 3: Authorization" icon="shield-halved">
    **OPA Policies** — Per-process access control. Every request is evaluated against Rego policies.
  </Accordion>

  <Accordion title="Layer 4: Credentials" icon="key">
    **Credential Injector** — Short-lived cloud tokens (15-60 min TTL). 3-tier cache with per-identity isolation.
  </Accordion>

  <Accordion title="Layer 5: GenAI" icon="brain">
    **LLM Guard** — Prompt injection detection, PII scanning, secrets scanning, invisible text detection.
  </Accordion>

  <Accordion title="Layer 6: Isolation" icon="box">
    **Firecracker Sandbox** — microVM code execution with hardware-level isolation. **Kubernetes Namespaces** — tenant isolation.
  </Accordion>
</AccordionGroup>

```
Identity (SPIRE) → Transport (mTLS) → Authorization (OPA) → Credentials → GenAI Guard → Sandbox Isolation
```

***

## What Each Layer Protects

| Layer                   | Threat                              | Protection                             |
| ----------------------- | ----------------------------------- | -------------------------------------- |
| **SPIFFE Identity**     | Impersonation, unauthorized access  | Cryptographic proof of identity        |
| **mTLS**                | Eavesdropping, MITM attacks         | All traffic encrypted with X.509 certs |
| **OPA Policies**        | Overprivileged access               | Per-process, per-service authorization |
| **Credential Injector** | Credential leakage, long-lived keys | 15-minute tokens, auto-rotated         |
| **LLM Guard**           | Prompt injection, PII leakage       | Multi-scanner pipeline                 |
| **Sandbox**             | Arbitrary code execution            | Firecracker microVM isolation          |
| **Namespaces**          | Cross-tenant data access            | Kubernetes namespace isolation         |

***

## Compliance

| Framework              | Status                               |
| ---------------------- | ------------------------------------ |
| OWASP Top 10 for GenAI | ✅ All 10 risks addressed             |
| SOC 2 Type II          | Architecture designed for compliance |
| NIST AI RMF            | Identity and risk controls aligned   |
| GDPR                   | PII scanning, data isolation         |
| HIPAA                  | Encryption at rest and in transit    |

See [Compliance Frameworks](/security/compliance-frameworks) for details.

***

## Deep Dives

<CardGroup cols={2}>
  <Card title="SPIFFE Identity" icon="fingerprint" href="/security/spiffe-identity">
    How per-process identity works.
  </Card>

  <Card title="OPA Policies" icon="shield-halved" href="/security/opa-policies">
    Write authorization policies.
  </Card>

  <Card title="Threat Model" icon="skull-crossbones" href="/security/threat-model">
    Attack chains and mitigations.
  </Card>

  <Card title="OWASP GenAI" icon="list-check" href="/security/owasp-genai">
    OWASP Top 10 for GenAI compliance.
  </Card>
</CardGroup>