All components are container‑native and can be deployed on any Kubernetes cluster. Security is enforced via mTLS (Istio) and JWT‑signed policy updates.