Security & trust
Your architecture blueprint stays under your control.
Enterprise architecture models map your core systems, network zones, sensitive data flows, and STRIDE threat models. Scapius is designed so your architectural source of truth lives in plain-text `.ea` files inside your own Git repositories rather than an opaque vendor database.
Architectural security principles
Local-first Git residency
All `.ea` source files live in your organization's Git repositories (GitHub, GitLab, Bitbucket, or Azure DevOps). You retain full custody of version history, backups, and repository encryption.
Zero external telemetry in Community
Scapius Community compiles and renders views locally on your workstation or in your private CI runner. No model contents, entity names, or usage analytics are transmitted to Scapius servers.
Verifiable audit trail
Every addition or modification to systems, data classifications, AI agents, and security controls is recorded as a signed Git commit with line-by-line pull request attribution.
Data handling and security controls by edition
Community is available today in beta. Enterprise BYOC and Enterprise Cloud columns describe planned security capabilities for upcoming multi-team deployments.
Community
Single local workspace for individual architects and domain evaluation.
- Execution boundary: Runs locally via Docker or native binary and inside your CI/CD runners.
- Data storage: Local `.ea` files on disk; no external database dependency.
- Network isolation: Operates offline or inside air-gapped developer workstations.
- Access control: Delegated to your Git host (`CODEOWNERS` and branch protection).
Enterprise BYOC
Coming soonCustomer-hosted deployment inside your private AWS, Azure, GCP, or on-premise Kubernetes cluster.
- Execution boundary: Deployed inside your private VPC or VNet with zero inbound internet exposure.
- Identity & access: Planned OIDC SSO, SCIM 2.0 provisioning, and workspace RBAC.
- Encryption: Customer-managed keys (CMK) for PostgreSQL metadata and TLS 1.3 in transit.
- Auditability: Planned immutable access and governance event logs exported to your SIEM.
Enterprise Cloud
Coming soonManaged cloud service operated by Scapius for organizations that prefer turnkey hosting.
- Tenant isolation: Planned logical tenant isolation with dedicated encryption keys per workspace.
- Identity & access: Planned OIDC SSO, SCIM 2.0 sync, and fine-grained RBAC.
- Git synchronization: Scoped, least-privilege webhook integration with GitHub, GitLab, or Azure DevOps.
- Compliance roadmap: Designed toward SOC 2 Type II and ISO 27001 controls prior to general availability.
Security and procurement questions
Does Scapius Community send architecture models or telemetry to external servers?
No. Scapius Community runs entirely on your local workstation or inside your private CI/CD runner. Your .ea files, compiled AST, and SVG/PNG exports remain on your filesystem and in your Git repository with zero external network calls or telemetry.
Why does data residency matter for enterprise architecture models?
An enterprise architecture model contains your organization's complete system topology, network zones, sensitive data lineage, and unmitigated STRIDE security threats. Keeping that blueprint in your own Git repository and private cloud avoids concentrating crown-jewel metadata in a third-party multi-tenant SaaS database.
How do we govern read and write permissions in Scapius Community?
In Community, access control is enforced by your existing Git platform (GitHub, GitLab, Bitbucket, or Azure DevOps) using repository permissions, branch protection rules, signed commits, and CODEOWNERS files.
What security controls are planned for Enterprise BYOC and Enterprise Cloud?
Planned Enterprise editions add OIDC single sign-on, SCIM 2.0 user provisioning, workspace role-based access control (Viewer, Editor, Admin), immutable audit logs, and TLS 1.3 encryption in transit and AES-256 encryption at rest.
Need a security architecture briefing or want to report a vulnerability?
Contact our engineering team for architecture review questionnaires, BYOC deployment topologies, or responsible vulnerability disclosure. See /.well-known/security.txt for disclosure details.