> ## Documentation Index
> Fetch the complete documentation index at: https://docs.flowx.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Security

> How FlowX secures the platform end to end, covering identity and access management, role-based access control, runtime authorization, audit, and AI data protection.

## Overview

FlowX security spans five layers, each documented in its own guide:

1. **Identity**: authentication is delegated to your identity provider through a standards-based IAM integration.
2. **Access control**: role-based access control (RBAC) governs what each user can do in the Designer, per organization, workspace, and project.
3. **Runtime authorization**: separate, project-scoped controls decide who can access a published solution at runtime.
4. **Auditability**: a dedicated Audit service records platform events in a centralized location.
5. **AI data protection**: personal data is detected and redacted before it reaches a model, and AI usage maps to regulatory controls.

This page routes to the detailed documentation for each layer.

***

## Identity and access management

FlowX delegates authentication to an external identity provider. Step-by-step configuration guides cover Keycloak and Microsoft Entra ID.

<CardGroup cols={2}>
  <Card title="IAM solution" icon="key" href="/5.9/setup-guides/access-management/access-management-overview">
    The identity and access management framework FlowX uses to control access to digital identities
  </Card>

  <Card title="Configuring an IAM solution (Keycloak)" icon="lock" href="/5.9/setup-guides/access-management/configuring-an-iam-solution">
    Step-by-step Keycloak setup for managing users, roles, and apps
  </Card>

  <Card title="Configuring an IAM solution (Entra ID)" icon="lock" href="/5.9/setup-guides/access-management/configuring-an-iam-solution-entra">
    Step-by-step Microsoft Entra ID setup for managing users, roles, and apps
  </Card>
</CardGroup>

***

## Roles and permissions

Access in the Designer is governed by RBAC at organization, workspace, and project level.

<CardGroup cols={2}>
  <Card title="Roles and permissions matrix" icon="table-cells" href="/5.9/setup-guides/access-management/roles-permissions-matrix">
    Detailed permission matrices for all FlowX roles across organization, workspace, and project levels
  </Card>

  <Card title="Workspaces access rights" icon="users" href="/5.9/setup-guides/access-management/workspaces-access-rights">
    Workspace-level access rights and role-based access control
  </Card>

  <Card title="Runtime authorization" icon="user-check" href="/5.9/setup-guides/access-management/runtime-authorization">
    Project-scoped roles, end-user groups, and solution sharing for controlling runtime access to published solutions
  </Card>

  <Card title="End-user access management" icon="user-group" href="/5.9/setup-guides/access-management/end-user-access-management">
    Managing access for the end users of your published solutions
  </Card>
</CardGroup>

***

## Audit

The Audit service provides a centralized record of platform events.

<CardGroup cols={2}>
  <Card title="Audit" icon="clipboard-list" href="/5.9/docs/platform-deep-dive/core-extensions/audit">
    The Audit service and the details captured for each audit event
  </Card>

  <Card title="Audit setup" icon="server" href="/5.9/setup-guides/audit-setup-guide">
    Deploying and configuring the Audit service
  </Card>
</CardGroup>

***

## AI and data protection

<CardGroup cols={2}>
  <Card title="Personal Information Guard" icon="eye-slash" href="/5.9/ai-platform/personal-information-guard">
    Detect and redact personal data (PII) before it reaches a model, and restore it afterwards
  </Card>

  <Card title="EU AI Act" icon="scale-balanced" href="/5.9/observatory/compliance/eu-ai-act">
    18 EU AI Act requirements mapped to Observatory controls, with scope by risk tier
  </Card>

  <Card title="Data architecture" icon="database" href="/5.9/docs/platform-overview/data-architecture">
    Which data stores FlowX uses, what each stores, and how they fit together
  </Card>
</CardGroup>


## Related topics

- [Extracting additional data in business rules](/5.9/docs/building-blocks/actions/business-rule-action/extracting-additional-data.md)
- [FlowX Engine setup](/5.9/setup-guides/flowx-engine-setup-guide/engine-setup.md)
- [FlowX Admin setup](/5.9/setup-guides/admin-setup-guide.md)
- [Runtime manager setup](/5.9/setup-guides/runtime-manager.md)
- [FlowX Data Search setup](/5.9/setup-guides/search-data-service-setup-guide.md)