A security document you can trust.

One tenant. Your environment. Nowhere else.

Regisseur is delivered as a self-contained stack — application, PostgreSQL database, authentication service, and API gateway — that you run inside your own infrastructure. Each customer stack serves exactly one tenant. There is no multi-tenant SaaS surface where customers share a database or an application instance.

A stack provisions itself into a single workspace on first run and then refuses to create a second one; workspace setup is reachable only through an internal, secret-gated path, so a stack cannot be turned into a multi-tenant host after the fact. For customers running several stacks, an optional operator console can sit above them for status and coordination — it reaches each stack only through that stack’s authenticated status API, never touching your database directly.

Your data never traverses a Regisseur-operated service. The blast radius of any issue is one tenant, in your environment, under your network and identity controls.

Encrypted under a master key we never hold.

Row-level security is enabled on every application table. Access is scoped by workspace membership that the server resolves from the session — the browser never asserts which records it may see, and object references in URLs are resolved through the same membership-scoped query, which prevents an authenticated user from reaching another tenant’s records by guessing an identifier.

Credentials are protected with a two-layer envelope scheme. A 32-byte master key is supplied at startup from your environment or secret store and is never stored in the database; each credential is encrypted under a unique per-credential data key, itself stored only in encrypted form under the master key, with AES-256-GCM and a random per-record initialization vector. Resolved secrets are cached in memory only briefly, and are never written to logs, returned in an API response, or persisted in clear text.

The default backend keeps encrypted secrets in your PostgreSQL database; the same interface drives HashiCorp Vault and Azure Key Vault for customers who want secrets held in an external KMS. In air-gapped mode the platform restricts itself to the local encrypted backend automatically. The stack ships with a gateway that can terminate TLS and is designed to sit behind your TLS-terminating edge, so transport encryption is enforced under your existing certificate and cipher policy.

Four ways in. No others.

Regisseur integrates with your identity provider over standard SAML 2.0 and OIDC, so multi-factor authentication is enforced by your IdP policy and authentication strength stays under your control. Even with SSO, access is not automatic: a user must hold a pending invitation before an account is provisioned, and just-in-time provisioning then maps them to one of four roles — technician, member, admin, and owner — with authorization checked on the server at each protected route.

Every request into the platform authenticates through one of four well-defined mechanisms, and no others. External and machine callers are never issued a user session token; each path carries only the privilege it needs.

Built to not phone home — and to prove it.

The result is a deployment that can run fully air-gapped by default, with a demonstrable, tested outbound posture rather than a promise. Optional collaboration channels (for example Microsoft Teams) are off by default and opt-in per workspace. When you enable one, you keep your core private with a relay pattern: a small, hardened component you host in your own cloud tenant is the only public entry point — it verifies each provider-signed message and forwards it inward over private connectivity you control (VPN, private link, or a dedicated circuit). Your Regisseur core is never directly exposed, and the channel can be turned off instantly.

Signed. Offline-verified. Installation-bound.

Container images and license files are signed with Sigstore cosign and verified offline against a bundled public key — verification makes no network call and depends on no external transparency service, so it works in an air-gapped install. The signing toolchain is pinned to a specific version with a checksum and built into the image rather than fetched at runtime.

Each license is cryptographically bound to the specific installation through a fingerprint derived from stable installation secrets. Copying a license to a different stack fails verification, and cloning an entire stack reproduces the same workspace rather than minting a new licensable one. Every change also runs an automated secret scan (verified secrets only) and a dependency vulnerability audit for high and critical advisories.

Not yet shippedA formal software bill of materials (SBOM) is on our roadmap.

In regulated operations, the record is the deliverable.

Regisseur treats the audit trail as a first-class product surface. Every meaningful action writes an immutable row to an append-only event ledger — node activations, agent completions, human decisions, recoveries, errors, and communications. Rows are never updated or deleted.

External parties are first-class records, not free-text metadata, and because a case is pinned to the exact version it started under, a later change never rewrites the history of a case already in progress.

Enforced by automation, not by convention.

Every push and pull request runs a release gate that includes:

• Static architectural guards that fail the build if core code crosses an isolation boundary, a public route imports a privileged database client, or a hosted-database reference is introduced.
• A model-key scan that fails the build if any language-model provider key is read from the environment.
• Type checking, linting, and a production build.
• A test suite with enforced coverage thresholds across the security-relevant core.
• Secret scanning (verified secrets only) and a dependency vulnerability audit for high and critical advisories.
• An API-route security inventory that classifies every endpoint by its authentication mechanism and fails the build if a route is left unclassified or the inventory drifts.

Fast versions of the isolation and key-scan checks also run locally before every commit, so violations are caught before they ever reach the shared branch.

One control stops everything — without losing state.

A single control halts all agent execution and background processing for a workspace without losing state: every queued task checks the halt flag before running. This is the primary “stop everything now” mechanism for an incident, and it preserves in-flight work so operations resume cleanly.

Because the workflow engine is event-driven and every step is recorded, a halted or interrupted case can be resumed from its last recorded state rather than restarted.

We are direct about this, because CISOs check it first.

Because Regisseur runs on-premise with your identity provider, your model provider account, and your keys, many controls a SaaS vendor would need to attest to are satisfied by your existing, already-audited infrastructure. For PHI workloads in particular, the platform is typically deployed so that Regisseur the vendor has no standing access to your data; the scope of any Business Associate Agreement should be assessed against your specific deployment.

Because it runs in your environment, security is a partnership.

This answers a first pass. For a deeper engagement, under NDA: