Security
Security isn't a feature. It's the architecture.
Operate runs inside your own infrastructure and connects to your systems in read-only mode. It reads your systems in place and proposes fixes as patches an engineer reviews and applies. You choose the AI provider, and that choice decides where investigation context goes.
Self-hosted · read-only · human-gated · bring your own AI provider
The foundation
Four guarantees built into how Operate works.
Runs in your infrastructure
Operate runs alongside your own app, inside your infrastructure. No new cloud accounts, and none of your logs, records, or code is routed through us.
Read-only, always
Everything Operate connects to is read-only, and every action is logged. It can't change production or your repository. Fixes arrive as a patch an engineer reviews and applies.
Fully auditable
Every step Operate takes is recorded. Logins, key changes, and investigations all land in an activity log you can export anytime.
Your AI provider, your keys
Bring your own AI — Claude, Codex, an enterprise model, or one you host yourself, using your own keys. You decide which model runs and where. With a model hosted in your network, investigation data stays there; with an external provider, the context an investigation needs is sent to that provider.
Security controls
How we keep your data safe.
Five promises, and the engineering that backs each one.
Your data stays yours
Operate touches three kinds of data: the data in your systems, the credentials you connect them with, and a usage record for billing. Here's where each one lives and how it's protected.
Your logs, records, and code are never sent to us
Operate is self-hosted: it runs as a Docker image inside your infrastructure and reads your systems in place, using read-only credentials you provide. With an external AI provider, the context an investigation needs is sent to that provider; with a model hosted in your network, it stays there.
The only thing sent to us is how much you used, for billing
Your App ID, an interaction ID, start and end times, input and output token counts, the model name, and the task type, sent over an encrypted connection. Never log lines, records, code, credentials, or findings.
Credentials you connect are encrypted before they're stored
Stored in your database only in encrypted form — using AES-256-GCM, the same encryption standard banks rely on — and decrypted only in memory at the moment they're used. You can revoke them at your provider at any time.
Everything Operate stores lives in your own database
Passwords and API keys are never stored as-is — only as one-way fingerprints (bcrypt hashes) that can't be reversed to reveal the original. Disk and at-rest encryption stay under your control, in your infrastructure.
You decide who gets in
Access is limited to who needs it, and can be shut off instantly.
Signing in takes more than a password
Two-factor authentication with time-based one-time codes (TOTP) from an authenticator app.
People see only what their role allows
Role-based access control separates administrator abilities from member accounts.
API keys expire on their own and can be revoked instantly
Keys are time-limited and shut off automatically when they lapse; revocation takes effect immediately.
Every action leaves a trace
Every action Operate takes — and every person who signs in — leaves a record you control.
Every sign-in, change, and agent run is logged
The audit log records every security-relevant event — sign-ins, settings changes, key management, and each step of an investigation.
You can export the log anytime
Exportable as JSON Lines, ready for your own review tooling.
Kept for a full year by default
365-day retention, configurable to your policy; older entries expire automatically.
Attackers hit a wall
The app hardens itself against common web threats out of the box.
Browsers are held on secure connections
HSTS and a Content-Security-Policy header are sent on every response.
Only web origins you approve can call it
A deny-by-default CORS allowlist — never a wildcard.
Repeated failed logins are blocked
Login attempts are rate-limited to stop password guessing.
Proven before it reaches you
Every update must pass automated security and quality checks before it reaches you.
Scanned for known security flaws
Trivy vulnerability scanning runs on every change in CI.
Passwords and keys can't slip into the code
Gitleaks scans every change for leaked secrets before it can merge.
Gated on code quality
A blocking SonarQube quality gate on every pull request.
Dependencies kept patched and up to date
Automated updates via Dependabot, with build actions pinned to fixed versions.
Your data
We never hold your data. You choose where it goes.
Operate runs inside your own infrastructure and never routes your logs, records, or code through us. To investigate, it sends the context it needs to the AI provider you configure. Host the model in your own network and that context stays there too.
Have a question, or need details for a security review? We're happy to walk you through exactly how it works.
What is sent to Operate
Only a usage record for billing: your App ID, an interaction ID, start and end times, input and output token counts, the model name, and the task type. No log lines, records, code, credentials, or findings. Data sent to your AI provider is separate and depends on which provider you configure.
Questions
What security reviewers ask first.
Inside your own infrastructure. Operate runs alongside your own app, with no new cloud accounts. Your logs, records, and code are read in place and never routed through us.
Two different destinations. To us, Operate sends only a usage record for billing: your App ID, an interaction ID, start and end times, input and output token counts, the model name, and the task type. To your AI provider, it sends the context an investigation needs, such as relevant log lines, records, and code. If you host the model inside your own network, that context stays in your network.
No. Everything Operate connects to is read-only, including your repository, and every action it takes is logged. It proposes fixes as a patch file. An engineer reviews it, applies it, and decides what ships.
Whichever AI you choose. You bring your own provider — Anthropic Claude, OpenAI, an enterprise model, or a private model you host yourself — using your own keys. With an external provider, the context an investigation needs is sent to that provider under your agreement with them. If your data is sensitive, host the model inside your own network and that context stays there.
Email us at [email protected]. We welcome reports from security researchers, reply to every one within 72 hours, and follow a clear, documented process to assess and fix issues quickly.
Have a question about security?
Email our security team and we'll get you what you need — architecture details, our incident-response plan, or anything else.