Every data governance policy is only as trustworthy as the infrastructure enforcing it.
Expanso Edge runs YAML-defined data-processing pipelines on connected customer-controlled nodes close to where data is generated. Customers choose the sources, processors, and destinations in each job and validate the complete deployment against their requirements.
Those nodes can operate in environments with different infrastructure, network, and security constraints. Container images are one part of that system, alongside host configuration, credentials, runtime isolation, update policy, monitoring, and incident response.
That’s why we’re announcing that Expanso is joining Chainguard’s Commercial Builds partner program, launching at ASSEMBLE 2026 in New York.
You Can’t Govern Data with Ungoverned Infrastructure
Most conversations about data security focus on how sensitive data is handled, where it may move, and which policies apply. Those questions matter enormously to the teams operating distributed data systems.
But there’s a layer underneath that gets far less attention: the security posture of the pipeline infrastructure itself. In a distributed deployment, every container image deployed to an edge location is a potential attack surface. Chainguard’s published data illustrates the broader software-supply-chain challenge across open source projects.
Software-supply-chain controls can help teams review where an image came from and what metadata accompanies it. Each customer must still assess the selected image, deployment configuration, update process, runtime, and surrounding controls for its own threat model.
Why Chainguard Fits How We Think
Chainguard’s philosophy mirrors something fundamental to how we built Expanso: fix the problem at the source, not after the fact.
Expanso runs customer-defined data-processing policies on connected nodes close to where data is generated. Chainguard applies its own approach to software supply chains: building images from verifiable source code and publishing supply-chain metadata such as SBOMs and attestations.
The practical connection is straightforward: a data-processing policy is only one layer of the deployed system. Teams also need evidence about the software artifacts and infrastructure that execute it.
What This Means for Expanso Customers
In practical terms, customers can evaluate Chainguard commercial images as one option for packaging Expanso Edge. The evaluation should verify:
- Image provenance and metadata
- Compatibility with the intended Expanso version
- Target platform behavior
- Update and rollback procedures
- Vulnerability-management requirements
- The surrounding runtime controls
Participation in the partner program does not by itself certify an Expanso deployment or establish a complete security or compliance outcome. Those conclusions remain specific to the customer’s full environment and evidence.
Container provenance and update evidence belong in the same deployment review as pipeline configuration and runtime behavior.
The Bigger Picture
Container-image provenance, dependency metadata, update cadence, and vulnerability response are increasingly part of enterprise deployment reviews. The exact requirements differ by organization and workload.
Upstream data control makes this both harder and more important. Harder because the blast radius of a compromised pipeline agent scales with every node running it. More important because the entire value proposition of controlling data at its source depends on organizations trusting the infrastructure that does the controlling.
Chainguard focuses on software-supply-chain artifacts. Expanso runs customer-defined data-processing pipelines. Customers can assess the two together as part of a broader deployment design.
