Private VPC
Run the control plane in your network; nothing leaves without your proxy.
Agent runs your security team can sign off on.
Download for macOSSSO, scoped permissions, audit trails, and deployment inside your own network.
audit · run/7c4d
run/7c4d actor:jlee@acme.dev scope:repo:billing
read 62 files policy:allow
command npm test policy:allow
patch 4 files policy:review
settle completed sso:ok mfa:okDeployment you control
The control plane where your security team wants it.
Self-hosted runners
Agent execution on machines you own, in regions you choose.
Pinned models
Pin model versions; upgrades are your change window, not ours.
Identity and access
Who ran what, with which scope, provable after the fact.
SSO / SAML
Okta, Entra, or any SAML 2.0 provider. SCIM provisioning included.
Scoped keys
Per-team API keys with repo, tool, and budget scopes enforced server-side.
Audit export
Every run, command, and patch streamed to your SIEM as structured events.
Procurement-friendly
The parts that usually slow adoption down.
Compliance
SOC 2 report, DPA, and security questionnaire responses ready on day one.
SLA + onboarding
Contracted uptime, a named contact, and rollout support for pilot teams.
Usage governance
Per-team budgets, hard caps, and monthly usage reports for finance.
Ready when you are.
Install the desktop app or the CLI, run one command, and review the first diff.