Platform
The runtime underneath the report
Where the investigation runs, what it reads, and where it is required to stop.
The same engine installs into your own cluster or runs on ours, and neither version can pass the approval boundary on its own.
How it runs
Choose a deployment model without changing the evidence contract.
Self-hosting via HelmBetaReviewed
Every action is cleared by a person
Production Master proposes changes; a person clears each one — approving that action, or pre-authorising its risk class for a single investigation with a time-boxed, revocable grant.
BetaReviewedRuns where your evidence lives
Self-host the runtime via Helm inside your own infrastructure, or use the managed service.
The investigation engine is identical.
No host lock-in
The runtime depends on no specific cloud or execution platform.
Hosting choices sit behind explicit interfaces.
Bring your own model keys
Point the runtime at your own LLM provider credentials, or use ours on the managed plans.
From alert to answer
7 stages. The investigation can stop at any of them, and it always stops before production changes. Select a stage to see what it produced in this sample.
Detect
An alert, a deploy or a direct request opens an investigation and starts gathering evidence from the sources you've connected.
Gather
Read-only connectors pull the deploy diffs, metric series, logs and cluster events inside that window.
Exhibit
Each source becomes a numbered exhibit, with its origin, timestamp and volume recorded alongside it.
Hypothesise
Candidate explanations are written as falsifiable statements that an exhibit could disprove, not as prose.
Challenge
Each candidate is tested against the exhibits. Rejections are kept, with the exhibit that rejected them.
Report
The surviving explanation, its citations, its confidence and the ledger of rejections are assembled.
Gate
A remediation is proposed and the investigation stops there. A human decides whether it is applied.
Stage 01, Detect. An alert, a deploy or a direct request opens an investigation and starts gathering evidence from the sources you've connected.
An agreed path, or no path
Five gates, named before evaluation starts: source, credential scope, evidence, audience, action owner.
Anything outside that agreement stays disconnected.
Run it where your evidence already is
The same runtime installs into your own Kubernetes cluster or runs on ours, and the investigation it performs is the same one either way.
Self-host via Helm — available now to closed-beta teams.