> ## Documentation Index
> Fetch the complete documentation index at: https://docs.flowx.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Security

> How FlowX secures the platform end to end, covering identity and access management, role-based access control, runtime authorization, audit, and AI data protection.

## Overview

FlowX security spans five layers, each documented in its own guide:

1. **Identity**: authentication is delegated to your identity provider through a standards-based IAM integration.
2. **Access control**: role-based access control (RBAC) governs what each user can do in the Designer, per organization, workspace, and project.
3. **Runtime authorization**: separate, project-scoped controls decide who can access a published solution at runtime.
4. **Auditability**: a dedicated Audit service records platform events in a centralized location.
5. **AI data protection**: personal data is detected and redacted before it reaches a model, and AI usage maps to regulatory controls.

This page routes to the detailed documentation for each layer.

> [!NOTE]
>
> For corporate compliance, including the ISO/IEC 27001 certification and SOC 2 attestations, see the [FlowX.AI Trust & Compliance page](https://www.flowx.ai/trust).

***

## Identity and access management

FlowX delegates authentication to an external identity provider. Step-by-step configuration guides cover Keycloak and Microsoft Entra ID.

> [card] [IAM solution](https://docs.flowx.ai/6.x/setup-guides/access-management/access-management-overview.md)
>
> The identity and access management framework FlowX uses to control access to digital identities

> [card] [Configuring an IAM solution (Keycloak)](https://docs.flowx.ai/6.x/setup-guides/access-management/configuring-an-iam-solution.md)
>
> Step-by-step Keycloak setup for managing users, roles, and apps

> [card] [Configuring an IAM solution (Entra ID)](https://docs.flowx.ai/6.x/setup-guides/access-management/configuring-an-iam-solution-entra.md)
>
> Step-by-step Microsoft Entra ID setup for managing users, roles, and apps

***

## Roles and permissions

Access in the Designer is governed by RBAC at organization, workspace, and project level.

> [card] [Roles and permissions matrix](https://docs.flowx.ai/6.x/setup-guides/access-management/roles-permissions-matrix.md)
>
> Detailed permission matrices for all FlowX roles across organization, workspace, and project levels

> [card] [Workspaces access rights](https://docs.flowx.ai/6.x/setup-guides/access-management/workspaces-access-rights.md)
>
> Workspace-level access rights and role-based access control

> [card] [Runtime authorization](https://docs.flowx.ai/6.x/setup-guides/access-management/runtime-authorization.md)
>
> Project-scoped roles, end-user groups, and solution sharing for controlling runtime access to published solutions

> [card] [End-user access management](https://docs.flowx.ai/6.x/setup-guides/access-management/end-user-access-management.md)
>
> Managing access for the end users of your published solutions

***

## Audit

The Audit service provides a centralized record of platform events.

> [card] [Audit](https://docs.flowx.ai/6.x/docs/platform-deep-dive/core-extensions/audit.md)
>
> The Audit service and the details captured for each audit event

> [card] [Audit setup](https://docs.flowx.ai/6.x/setup-guides/audit-setup-guide.md)
>
> Deploying and configuring the Audit service

***

## AI and data protection

> [card] [Personal Information Guard](https://docs.flowx.ai/6.x/ai-platform/personal-information-guard.md)
>
> Detect and redact personal data (PII) before it reaches a model, and restore it afterwards

> [card] [EU AI Act](https://docs.flowx.ai/6.x/observatory/compliance/eu-ai-act.md)
>
> 18 EU AI Act requirements mapped to Observatory controls, with scope by risk tier

> [card] [Data architecture](https://docs.flowx.ai/6.x/docs/platform-overview/data-architecture.md)
>
> Which data stores FlowX uses, what each stores, and how they fit together


## Related topics

- [Extracting additional data in business rules](https://docs.flowx.ai/6.x/docs/building-blocks/actions/business-rule-action/extracting-additional-data.md)
- [FlowX Engine setup](https://docs.flowx.ai/6.x/setup-guides/flowx-engine-setup-guide/engine-setup.md)
- [FlowX Admin setup](https://docs.flowx.ai/6.x/setup-guides/admin-setup-guide.md)
- [Application Manager setup](https://docs.flowx.ai/6.x/setup-guides/application-manager.md)
- [Runtime manager setup](https://docs.flowx.ai/6.x/setup-guides/runtime-manager.md)


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.