Mendix 11 pairs application-level security controls with portfolio-wide governance, giving developers hardened defaults inside Studio Pro and giving company admins centralized oversight of users, licenses, dependencies, and policy compliance across the whole landscape.
This is one part of a larger picture. How and where you actually run these apps – Kubernetes, Azure, the portable runtime, zero-downtime releases, and observability – is covered separately in our Mendix Cloud series, because those capabilities apply no matter which Studio Pro version you are on.
Portfolio governance and oversight
Mendix Policies let you define governance rules once and apply them to specific apps or the entire portfolio. You can start from ready-to-use templates or write custom, deterministic (no-AI) rules covering runtime version, Marketplace license type, Marketplace support status, and Software Composition findings, and the platform tracks violations per app. The current release is visibility-only, with enforcement noted as coming.
Central Audit Logs consolidate all audit activity in the Control Center behind a searchable UI, covering user and administrative changes across the platform. Logs can be exported to CSV and streamed to a SIEM through the Audit Log API.
- Project categorization – company admins define custom categories (for example department, cost center, or team ownership) and project admins assign them in Project Settings, enabling filtering and portfolio-scale management.
- Role and invite controls – company admins can restrict project invites to approved email domains, only company admins can define roles, roles include public-cloud environment permissions, and the Project API supports role-based team assignment.
- Admin management – Mendix admin management lives in the Company section of the Control Center, and a corporate identity provider can control platform admin access based on group membership.
- Contract compliance notifications – email reminders begin 90 days before a contract expires and in-platform banners appear 30 days prior, surfaced on the Mendix home page.
- AI governance – a project-level setting lets teams opt out of Maia AI assistance in Epics and App Insights, part of the broader enterprise AI governance story for smart and agentic apps.
License and user governance
End User Telemetry centrally tracks active named users across all production apps, categorizing them as Single-App Internal, Multi-App Internal, and External Users. Identities are hashed at the source with automatic cross-app deduplication using a Named User Identifier (typically an email address) so people who use multiple apps are not double-counted. It is fail-safe – exceeding seat limits does not disrupt apps – and supports license governance and consumption optimization.
- User Classification Module – classifies users as internal or external to keep license accounting compliant with the Mendix Pricing Plan, classifying new users automatically and updating existing users via an admin action based on roles or a custom microflow.
- Platform User Deactivation API – automatically offboards and deactivates platform users, blocking further access and revoking Personal Access Tokens.
Identity, authentication, and user provisioning
OIDC single sign-on supports certificate-based authentication via private_key_jwt and automatically extracts identity-provider roles from ID tokens, mapping them to Mendix user roles through a microflow. The module adds token encryption, refined admin access for persisted tokens, an improved nonce implementation, and a streamlined upgrade path with a migration flow for older versions.
SAML single sign-on supports horizontal scaling so SSO works across multi-instance deployments serving high volumes of concurrent users, and a constant-based configuration enables custom SAML microflow automation for simpler upgrades. The Forgot My Password module likewise works across horizontally scaled deployments.
- SCIM provisioning – supports expanded user attributes (displayName, language, locale, timezone, and profile URL) plus bulk user removal and client deletion for complete automated onboarding and offboarding across environments.
Application and runtime security
The access rules editor is integrated into the entity Properties pane, replacing the deprecated standalone editor. Inherited attributes and associations are marked with a distinct icon, module roles are sorted alphabetically for easier scanning, rules opened from the Changes or Error panes are highlighted rather than reopened, and System entity rules can be viewed read-only.
Session lifetime controls include the AbsoluteSessionTimeout runtime setting, which enforces a maximum session lifespan and expires sessions whether or not they are active, complementing the existing inactivity timeout for regulated industries handling confidential information.
Anonymous-access safeguards present a confirmation dialog when enabling anonymous user access and warn that unrestricted anonymous roles can expose data.
- CORS for built-in XAS APIs – CORS configuration extends beyond REST services to the built-in XAS APIs, letting you control which external origins can reach client-facing endpoints, with the runtime responding to CORS preflight (OPTIONS) requests using configured custom headers.
- CSRF token client API – a getCSRFToken method from mx-api/session lets client code retrieve the CSRF token, for example when making secured REST service calls.
- Security overview export – the mx export-security-overview command outputs the security overview to JSON or XLSX with filtering options for offline auditing and compliance reporting.
- Entity access on ShowHomePage – the System module’s ShowHomePage microflow enforces entity access, requiring explicit security configuration.
- Hardened session and credential handling – expired web service user sessions are removed automatically, passwords can no longer be modified through the synchronize_objects API even with write access, and the login flow avoids resetting an already-zero failed-login count.
- Version control and dependency hardening – the security of Git process execution during version control was improved, an arbitrary code execution flaw in Studio Pro was fixed, and Netty dependencies were upgraded to address roughly ten CVEs.
Software supply chain security
Software Composition gives you visibility into component dependencies – modules, widgets, Java libraries, runtime versions, and npm packages – at both application and landscape levels. It tracks outdated and deprecated dependencies and automatically surfaces known Mendix and Siemens vulnerabilities, prioritized by CVSS score from critical to low with actionable recommendations, flagging unsupported versions with a warning icon.
Marketplace security automatically scans all public submissions with QSM technology, auto-declining components with high or critical vulnerabilities and notifying submitters with a link to the issue report so they can fix and resubmit for automatic publication. Component owners can flag releases as security fixes, select affected versions, and add CVE or CWE identifiers, with subscribers notified. A Company Approved label – extended to private components with unified Studio Pro filtering – helps developers identify production-ready, approved resources.