Trust & procurement
The answers your security review will ask for.
Written for the person who has to sign off, not the person who wants the demo. Where a claim is strong, it is checkable; where the honest answer is "not yet", this page says not yet.
Architecture and data flow
The shortest version: your data does not come to us, because there is nowhere for it to go.
Where the code runs
The collector runs in your cluster, as a short-lived Job with a read-only ClusterRole, and writes a single estate.json to your side. You render that file at /report/live, where it is parsed and scored 100% client-side, in your browser. No upload, no telemetry, no account.
Where your data lives
v1 has no SaaS backend holding customer data — that is not a policy promise, it is an architectural fact you can verify in the browser's network tab while the report renders. The two real collected snapshots demonstrated on /report/live are our own clusters, published by us; yours stays yours.
Exactly what is collected
Metadata about capacity and placement — not payloads, not credentials.
- Nodes — capacity, allocatable GPUs, labels, conditions.
- Pods / workloads — metadata: resource requests, owner references, restart counts.
- PodDisruptionBudgets — they feed the criticality heuristic.
- Events — control-loop churn, attributed by actor.
- Metrics — metrics.k8s.io utilization when present.
- DCGM (optional) — GPU utilization, temperature, ECC/XID counts, if an exporter exists.
And what is not: no Secrets, no ConfigMap bodies, no environment variable values, no pod/exec, no write verbs of any kind. The ClusterRole that enforces this is printed verbatim on /methodology — the page must never promise less than the chart requests, and your platform team can diff the two in one sitting.
Deployment models
One shipping today, one on the roadmap — labeled as such.
Report-only (today)
Run the collector when you choose — manually or as the Helm Job — and render the snapshot yourself. Nothing resident, nothing phoning home; uninstall removes everything including the RBAC.
In-cluster resident collector (roadmap)
A continuously-running in-cluster collector is planned, with the same read-only permission surface. It does not exist today, and we will not pretend otherwise in a security questionnaire.
Security posture, honestly
A checklist answered the way we would want a vendor to answer us.
- Company: solo-founder. That is a risk you should size rather than one we hide — and the product's own blast radius is near zero by construction: read-only collection means the worst case of the vendor disappearing is a report that stops updating, not a cluster that breaks.
- SOC 2: not yet started. It is planned alongside the first paying pilot — an audit before there is production customer data to protect would be certification theater, and this page does not do theater. Until then, the honest control is the architecture above: your data never reaches us.
- Disclosure culture: bugs found against real collected data are fixed and disclosed in the open — the public commit history names them (including the ones found running against our own production snapshots), alongside the CI, parity tests, and golden files you can run yourself.
- Supporting infrastructure: the lead-capture and conference-booth services are demo-grade by design and handle no cluster data. Treat them as marketing plumbing, because that is what they are.
Application security
The primary control is architectural — your cluster data never comes to us. These are the conventional controls the site and its supporting services ship anyway, listed because a reviewer will look for them.
- Security headers, site-wide: Content-Security-Policy, X-Content-Type-Options: nosniff, X-Frame-Options: DENY, and a Referrer-Policy — on every page, not just the front door.
- Auth endpoints: CORS locked to the site's own origin; failed logins are rate-limited and answer with Retry-After.
- Sessions: expire after 24 hours.
- Lead data: stored on a Kubernetes PersistentVolume, applied in production — it survives a pod restart, and it is the only customer-supplied data the platform holds (contact details, not cluster data).
Continuity
What happens to you if something happens to us.
- Auditable source: the collector is a single stdlib-only Python file — reviewable in one sitting, runnable without us.
- Self-hostable rendering: the report renders client-side from your estate.json; the rendering can be self-hosted, so a collected snapshot stays readable regardless of this domain's fate.
- Escrow: available for design partners — put it in the pilot terms and we will sign it.
Pilot terms live on the pilot page
Scope (Observe + Report + one governed PR — autopilot and DCIM integration explicitly out), the responsibility split, and the go/no-go criteria are written out on /pilot so procurement and delivery read the same document.