The questions an architect asks before a pilot, answered on one page: the shape of a deployment, the data that leaves a host, the systems it plugs into, and the things it deliberately does not do.
A small Rust agent runs as a service on each host. There is no kernel module and no driver to install. On Linux 5.8 and newer the deep sensor uses eBPF; where it cannot, the agent falls back to inotify and auditd and says so in its own status. On Windows it reads ETW and the USN journal.
The agent dials out over gRPC on TLS 1.2 or better and keeps one stream open; commands ride back down that stream. Nothing connects in to your hosts, so no inbound firewall rule is needed. Mutual TLS and SPKI certificate pinning are both available, and a malformed pin stops the agent at startup rather than running unpinned.
An API, a gRPC ingest tier and a set of workers, on PostgreSQL, ClickHouse, Redis and NATS, with reports written to S3 or MinIO. Tenants are separated in the database itself with row-level security, on a role that cannot bypass it.
.deb and .rpm for amd64 and arm64, an MSI for 64 and 32 bit Windows, and a plain static binary that runs on old glibc distributions. Install scripts are generated per platform, and an Ansible role ships with the agent.
Agent updates roll out in rings with a canary and automatic rollback. A separate updater verifies a pinned trust root before it swaps anything, refuses to move to an older version, and resumes or rolls back an update that was interrupted by a reboot.
Uninstalling can be authorised with a signed token that the agent verifies offline, so a host that has lost its link can still be cleaned up.
The binary hashes itself at start-up, the binary and unit files can be made immutable, and remote commands can be required to carry a signature.
The point of the product is evidence about files, not the files. What the agent sends is bounded and listed here.
An adaptive governor targets 70 percent CPU, runs the work at low priority, and slows itself down file by file as load rises rather than stopping and lurching.
When the link is down, events queue on disk, encrypted, up to 500 MB by default, and are only dropped from the queue once the server has acknowledged them.
The ingest tier rate-limits per agent, so one noisy host cannot crowd out the fleet.
A Kubernetes chart with autoscaling, disruption budgets, network policies and a migration job, or a single-node compose stack for a smaller estate.
The same build, operated by us, with tenants separated in the database and data kept in the European Union.
An offline bundle carries the chart and every image with signatures and a software bill of materials; the install refuses an image that is not on your own mirror, and the licence is activated from a signed file.
A buyer finds this out eventually. Better here than three weeks into a pilot.
It does not block, isolate a host, quarantine a file or kill a process. It detects, explains and evidences; the response is yours.
It is not a content inspector. There is no data-loss prevention, no scanning of file contents for personal or card data.
The agent has no proxy support: it needs a route to the ingest endpoint, through your own edge if you terminate there.
A published OpenAPI document does not exist yet.
There is no SCIM provisioning; accounts arrive through single sign-on or LDAP.
In an air-gapped install, vulnerability and end-of-life data does not refresh by itself.
There is no macOS build today, and on kernels older than 5.8 the deep sensor runs in its fallback mode.
Walk through a topology like yours with us: what runs where, what leaves a host and what never does.
Book an architecture session