---
titel: "Security"
adresse: https://anvil-coder.tech/en/security
beschreibung: "Anvil Coder separates tenants in the record rather than in a filter, requires each organisation's own model key on the Claude paths and enforces encrypted credential storage in the hosted service. Where generated code is built and tested in the hosted service, it happens in an unprivileged pod instead of the coordinator."
sprache: en
---

Security

# What fails when something is missing

At the points where Anvil Coder executes foreign code and manages foreign credentials, it is deliberately built so that a missing value leads to an abort instead of a silent workaround. That is the most important property of a security architecture: not what it does in the normal case, but what it does when something is missing.

## Five boundaries

**The tenant is part of every request**

Not a filter one can forget, but part of the record and of the request: in the hosted service, every access to the factory carries its tenant, and one organisation’s data simply does not exist for members of another.

**On the Claude paths: no key, no run**

On the Claude paths nothing runs without your organisation’s key: the service rejects the request with 401. For OpenAI-compatible providers, the organisation’s key acts as an override of a configured default.

**Keys stored encrypted**

In the hosted service this is enforced: without a configured storage key the service refuses to start, and credentials are stored encrypted instead of in plain text. Self-hosters must set this key — without it, credentials are stored unencrypted.

**Building and testing without privileges**

Where generated code is built and tested in the hosted service, it happens in an unprivileged, throwaway pod instead of the coordinator. Foreign code is executed there — which is exactly why it runs where it can reach nothing. Self-hosters have a legacy choice, "analyzer=gradle", that removes precisely this boundary: there the generated code runs inside the coordinator process.

**Repository access stays with the coordinator**

The worker never sees your repository token. It clones and pushes through an opaque in-cluster address; only there is the credential applied. What it carries is a short-lived pass the coordinator issues per run, scoped exactly to your organisation and project — a foreign or expired pass is rejected. The generated code cannot issue itself one: the seal is not in its hands. In the hosted service, startup additionally aborts if this seal is missing.

## Why failing is the right default

The convenient construction is the opposite one: if a key is missing, take the shared one; if the tenant is missing, show everything. Both conveniences are invisible in normal operation and, in the failure case, are the damage itself.

Anvil Coder decides the other way at the points named above: on the Claude paths the service rejects a request without the organisation's key with 401, and in the hosted service no request reaches the factory without its tenant. That is more annoying during setup — you notice immediately when something is missing — and exactly therefore correct.

## Where the data lives

Operations run on the Infomaniak Public Cloud in Switzerland. For teams that have to justify data sovereignty, that is not a side note but often the first question.

The models themselves naturally live with their providers. The connection is interchangeable and covers local models via Ollama — which provider runs is a deployment decision. Compute time can be priced; if a price is set, runtime flows into the cost accounting. Without it, local models run at cost zero.

The operations behind it

- Infomaniak

- Kubernetes

- Flux CD

- PostgreSQL

- Keycloak

## Security review ahead?

Then let's walk through the items on your list — with the source code next to it instead of a brochure.

[Start for free](https://app.anvil-coder.tech/register)[Book a demo](https://anvil-coder.tech/demo)