Read-only, by design.
Obsilient needs to know how your agent system is built and how much work passes through it. It does not need your data, your prompts or your model outputs, and the connector is built so it never sends them.
Read-only
The connector reads your code, configuration and run logs. It never writes, and it never runs your code, your agents or your models.
Facts, not content
It sends the structure of your system and counts of work. Never source code, prompts, model outputs or the data your agents handle.
Encrypted
Everything it sends travels over an encrypted channel, authenticated with a key issued for your engagement.
You control removal
Remove it with one command, or delete its container. Nothing of Obsilient stays behind.
The shape of your system, never its contents.
The connector reads
- Your agent code
- Configuration files
- Scheduler and pipeline definitions
- Run logs
What leaves your environment
- Which components exist and how they connect, named as they are in your code
- Counts of how much work passed through each component over a period
- The connector’s own version, so findings can be traced to what ran
What never leaves
- Source code text
- Prompts, model inputs and model outputs
- The data your agents work on
- Secrets, keys and credentials
- Message contents from your run logs
See it before it is sent
The connector can write what it would send to a file instead of sending it, so your team can read exactly what would leave your environment before anything does.
Nothing to install beyond the connector.
The engine is delivered as a service, so there is nothing to install beyond the connector. The connector carries none of the engine: it reads, extracts the facts and sends them, and that is all it does.
If nothing may leave your environment, there is an on-premises option: a signed, licensed container that runs inside your environment for the term of your subscription.
Small, predictable, removable.
- It needs read access only, scoped to the system in the engagement.
- It opens no inbound port. It only connects out, to Obsilient, over an encrypted channel.
- It does not run your code, call your models or start your agents.
- It authenticates with a key issued for your engagement, and the key ends with the engagement.
- It holds no findings and makes no judgement. Those come from the engine, as a service.
Held for the engagement. Deleted at the end.
We hold what the connector sends only for the engagement. When it ends, it is deleted within the window agreed at the start, and we confirm the deletion in writing.
Removing the connector takes one command, or deleting its container. The gate switches off when the licence lapses, and it is built so that switching off never blocks your deploys. You keep every report we issued.
Bring your security team’s questions to scoping. We answer them before anything is installed.
Run agents in production?
We are working with a small number of early teams. Tell us about your system and we will tell you plainly whether Obsilient fits.