Security & supply chain

Trust you can verify, not just take on faith.

Elixium runs on a hardened, signed container supply chain we build and maintain in-house, with FIPS-mode cryptography, a full bill of materials on every image, and provenance anyone can verify offline. The same platform, whether it runs in our cloud or inside your air-gapped enclave.

What you get

Security as a property of how it's built.

Hardened & minimal by construction

Our runtime images are distroless: no shell, no package manager, nothing but the runtime and the app. Least-functionality is a property of how the image is built, not a policy applied after.

Signed, with a full bill of materials

Every image carries a cryptographic signature and a complete SBOM, attached in the registry. Anyone can verify what is inside and that it came from us, unmodified, offline, without trusting a third party.

FIPS-mode cryptography, built in

Our FIPS image variants operate in FIPS mode with approved-algorithms-only enforcement, proven active on every build. The control lives inside the container, where the cryptographic work happens.

Air-gap ready

The entire image set moves into a disconnected environment with signatures and SBOMs intact. Built for the enclave, where "just pull it from the vendor" is not an option. Full enclave deployment is in early access today.

Continuously rebuilt & scanned

Images are rebuilt on a cadence we control, so vulnerabilities are eliminated at the source rather than patched around. Each image ships with its scan report and severity scope.

You hold the keys, and the capability

Self-hosted means you own the data, the database, and the encryption keys. The supply chain that produced your images is ours to run and yours to verify.

The supply chain we own

Trusted in. Hardened, signed, FIPS-enabled out.

A closed loop we run end to end. Vetted components become hardened, verifiable images, and Elixium is assembled only from images we built and signed.

Harden01

distroless, minimal

Scan & gate02

block on severity

Generate SBOM03

full bill of materials

Sign04

verifiable provenance

FIPS-enable05

approved algorithms only

FIPS-mode cryptography

Approved algorithms only, and we prove it every build.

Our FIPS image variants ship a cryptographic module that operates in FIPS mode: non-approved algorithms are rejected, and the module runs its power-on self-test before the image is allowed to ship. It is the control implemented inside the container, where the cryptographic work actually happens, not a claim on a datasheet.

For programs that require a formal certificate, there is a clear upgrade path to a CMVP-validated cryptographic module. We'll name the module and the certificate for your assessment when a contract requires it.

For regulated & government programs

Controls implemented by construction.

Evidence-producing controls that support CMMC and FedRAMP-adjacent programs, implemented in the artifact, not asserted in a document.

Least functionality. Distroless removes the shell and package manager; minimal by construction.

CM-7

Software integrity. Signed images + full SBOM give supply-chain requirements a machine-verifiable answer.

SI-7 / SR

Flaw remediation. Continuous rebuilds address vulnerabilities on a cadence you control.

SI-2

Cryptographic protection. FIPS-mode, approved-only cryptography inside the image; validated-module upgrade path.

SC-13

For AI-assisted delivery

Humans approve, AI executes, as controls, not policy prose.

Every agent connects under its own OAuth identity. Everything it does is attributed, gated, and auditable, the same bar your human team ships through.

Audit events, end to endEvery mutation emits an audit event: actor, tenant, action, object, timestamp. Agent actions record both the agent identity and the authorizing human.

AU-2

Human-endorsed AI workAgent-drafted work stays a proposal until a human endorses it, and the accept/reject is its own audited event, completing the accountability chain.

AC-5

Tenant isolation, fail closedRow-level security enforced in the database, a membership gate at the router, and RBAC that denies when access is unresolved.

AC-3 / AC-6

Retention & disposalPer-workspace retention windows, provenance-tracked purge, and restore-from-trash, governed by a written retention policy.

SI-12

Control mappings indicate where our artifacts provide implementing evidence. Assessment and authorization decisions rest with your assessor and authorizing official.

Also worth reading

Runtime & platform security

This page is about how Elixium is built. For how it behaves at runtime, OAuth 2.1, RBAC, tenant isolation, encryption in transit and at rest, see the platform security controls.

Platform & API security →

Deploying into a regulated or air-gapped environment?

Talk to us about self-hosted and FIPS-enabled Elixium, SBOM and signature verification, and what an air-gapped deployment looks like for your program.

Talk to IndirectTek Self-Hosted Docs

Vulnerability disclosure

Found a security issue? Tell us.

We welcome reports from security researchers and anyone else who finds a vulnerability in Elixium. Email [email protected]. This policy is the one our security.txt points to.

How to report

Send your report to [email protected].
Describe the issue, where it is (URL, endpoint or component) and the steps to reproduce it.
Tell us the impact you think it has, and include any proof of concept.
Tell us how to reach you. You may report anonymously, but then we cannot follow up.
Do not include other people’s personal data or customer data in the report.

What to expect

On receipt: An automatic reply confirms your report reached us.
Within 5 business days: A person on our security team acknowledges your report.
Within 10 business days: We share our initial assessment: whether we can reproduce it and how serious we think it is.
Until it is resolved: We update you at least every 30 days and tell you when the fix ships.
Before you publish: Please give us 90 days from your report, or until the fix ships if that is sooner, before you share details publicly. If we need longer, we will tell you why and agree a date with you.

Scope

In scope

elixium.ai and its subdomains
The Elixium SaaS service and its APIs, including the MCP server
Elixium software and container images published by IndirectTek
IndirectTek-published code repositories

Out of scope

Workspaces or accounts you do not own
Third-party services we do not operate
Social engineering or phishing of our staff or customers, and physical attacks
Denial-of-service, volumetric or high-traffic automated testing
Automated scanner output without a demonstrated security impact

We do not run a bug bounty program and do not pay for reports.