Security isn't a feature. It's the foundation.
The platform was built security-first: least privilege, encryption at rest, and a tamper-evident audit trail are how it works — not add-ons you bolt on later.
Six layers, one promise
Encryption everywhere
Connection credentials are encrypted with AES-256-GCM at rest, never returned by the API, and never written to logs — verified by tamper/forgery tests.
Least-privilege RBAC
Seven built-in roles plus custom roles across two tiers, enforced at the API. Members can be confined to specific workspaces — even for direct by-id access.
Immutable audit trail
Every privileged action writes to an append-only log enforced at the database level — no updates, no deletes — filterable and exportable.
Pluggable secret backends
A KeyProvider abstraction means you can keep keys in env, or in HashiCorp Vault, AWS Secrets Manager, or Azure Key Vault.
On-prem connectivity
A hardened, mTLS, auto-updating agent brokers operations to databases that never leave your network. Self-host the whole platform if you need to.
Observability built in
OpenTelemetry traces, a Prometheus metrics endpoint, and trace-correlated logs make the control plane itself auditable.
Evidence in a click, not a quarter
Map your audit trail to the frameworks your auditors actually use.
SOC 2
Trust Services Criteria — map audit events to controls and export evidence as JSON, CSV, or PDF.
ISO 27001:2022
Annex A control mapping with the same one-click evidence export for your ISMS.
GDPR-ready
Data minimization, encryption at rest, and a complete access trail for accountability.
Run a security review with us
We'll walk your team through the architecture, the threat model, and the audit trail.
SOC 2 & ISO 27001 aligned · Self-hosting available · AES-256-GCM at rest