Platform · Security
Split the plane. Keep write keys at home.
RemOps SaaS investigates and gates approvals. RemOps Agent executes inside your network. That is not a marketing footnote — it is how the product is built, and why production teams can say yes.
01 · Split plane
Cloud brain. Cluster hands.
Intake, investigation, and approval live in RemOps SaaS. Execution identity lives with your agent. We never need standing write credentials to your production Kubernetes API for the default path to work.
- SaaS: webhook, investigate, approve/reject
- Customer: agent poll, local execute, result report
- Pull model — no inbound shell from RemOps to your nodes
┌─ RemOps SaaS ─────────────┐ │ intake · investigate · gate │ └──────────┬────────────────┘ │ pending actions (pull) ┌──────────▼────────────────┐ │ your network · RemOps Agent │ │ execute · verify · report │ └───────────────────────────┘
02 · Data
Only what investigation needs — encrypted, scoped, yours
Integration credentials are encrypted at rest. Alert payloads and investigation artifacts stay scoped to your organization. Your production data is not a shared training buffet.
- Org-scoped incidents and keys
- Encrypted integration secrets
- Least-privilege reads encouraged per connector
Minimal access
Read what RCA needs. Write only after approve, via agent.
Customer isolation
Organization boundaries on incidents, keys, and agent tokens.
No silent training
Your incident data is not used to train models for other customers.
03 · Access
Keys for intake. Tokens for agents. Humans for approve.
Alert intake uses org API keys. Agents use install tokens and registration. Humans authenticate to the dashboard to approve. Three different doors — on purpose.
04 · Audit
Every approve is a record. Every execution is a result.
Postmortems and security reviews should not require archaeology. RemOps keeps the chain: alert → report → plan → approver → agent result.
- Approver identity and timestamps
- Action payloads and outcomes
- Reject paths preserved
Shipping every week.
- Split-plane executionSaaS never runs customer writes.
- Encrypted credentialsIntegration secrets at rest.
- Agent tokensScoped install identity for clusters.
- Approval auditHuman gate with attribution.
Frequently asked questions
We align controls to enterprise expectations (encryption, isolation, audit, least privilege) and expand formal certifications with customer requirements. Ask us for the current compliance roadmap.
The agent already runs in your network. Talk to us about deeper deployment options if SaaS intake/investigate must also stay private.
Alert payloads you POST, investigation artifacts derived from connected read integrations, and agent heartbeats/results. Write operations stay local to the agent.
Rotate or delete org API keys and agent tokens from the dashboard; disconnect integrations; remove the Helm release.
See In-cluster execute for the agent loop details.
Say yes to AI that respects the boundary.
Investigate in the cloud. Approve as a human. Execute at home.