What leaves your estate.

Triage reasoning happens on Kybit's own hardware. One second opinion is asked of Azure OpenAI in an EU region, and it is asked in pseudonymised form: network identifiers are replaced with stable tokens and the customer's name is replaced with a placeholder.

Pseudonymised is not anonymised. Account names, hostnames written as bare words, privilege group names, business-system names, ticket references and the analyst-readable narrative are sent as written. A tenant that cannot accept this is set to the policy none, and nothing leaves at all.

Hosted mode takes three independent gates, all default-deny: a deployment switch set in the environment, the tenant policy set to hosted_raw, and a recorded acknowledgement naming who accepted it and when. A database constraint refuses a tenant row that names a hosted provider without the last two. If any part is missing, the tenant falls back to local reasoning. A hosted provider selected without credentials errors rather than silently running locally.

The deployment switch lives in the environment, not the database, on purpose: restoring a backup, cloning a tenant into staging or redeploying an older configuration must not start an egress the operator of that environment never agreed to.

For the second-opinion hop in hybrid mode, by data class:

Which fields may be sent is declared exhaustively in the agent's egress registry, and a field that is not classified does not compile. Every judge call runs an assertion that the payload is pseudonymised before it is sent.

Token mapping is per triage. The same address gets the same token within one incident and a different one in the next, so the processor cannot correlate a host across incidents or across customers. The map that would reverse the tokens is kept on the host that made it and is never transmitted.

• The egress policy in force for the tenant at the time.
• Whether the judge was actually called, and which one.
• Token counts in and out.
• A fingerprint of the token mapping that pins which mapping was used without retaining it.

A per-call egress ledger: one append-only row per off-box request with tenant, provider, region, payload hash and size. Today the decision record is written once per incident, so a re-triage overwrites it and a retried call is two requests against one row. When a customer asks what left their estate, that question deserves a query behind it rather than a narrative. It is the next item on this work, and this page will say so when it ships.

• Tenant isolation by row-level security in PostgreSQL, identical across all three services.
• Argon2id password hashing; SSO and SAML with encrypted configuration.
• Nonce-based content security policy on every response.
• Break-glass overrides that expire, cannot be self-granted and are audited.
• Sliding-window rate limits on login by address and by account.
• A security test suite covering row-level isolation, SQL injection vectors, replay and CSP; load tests to 500 concurrent virtual users.
• The agent has no route to execute a playbook. The most it can do is write one advisory row; execution sits behind role checks and approvals elsewhere.
• A kill switch checked before any autonomous claim, and an append-only investigation trace.

• On-premises with Docker Compose, on your hardware or Kybit's.
• Production high availability: Patroni for PostgreSQL, PgBouncer, keepalived, HAProxy with TLS termination.
• A dedicated inference node running Ollama, reachable only on the LAN; the agent refuses an off-premises reasoning endpoint at configuration load unless the operator explicitly trusts that address range.
• An Azure development deployment defined in Bicep.