How it works
From one command to your first answer, in about a minute.
One agent per server reads what is already there and reports it. Demerzel keeps those reports as evidence and turns them into answers. Here is every step, and every byte.
Sign up
An emailed code, or Google, GitHub, Microsoft or GitLab — no password to invent. Then add a passkey if you like. Create an enrollment token from the Agents page.
Install the agent
A single static binary for Linux and macOS, amd64 and arm64. The installer checks its checksum; the service script creates an unprivileged user, enrolls, and starts it.
Read your first answers
The server shows up within a minute. Health Score, checklist and Actions fill in as the first reports are processed.
# install the binary (checksum verified) $ curl -fsSL https://get.demerzel.cloud/install.sh | sh # run it as a service, enrolled with your token $ curl -fsSL https://get.demerzel.cloud/service.sh | sudo sh -s <your-token> # optional: let it read web and SSH logs $ curl -fsSL https://get.demerzel.cloud/service.sh | sudo sh -s grant-web-logs $ curl -fsSL https://get.demerzel.cloud/service.sh | sudo sh -s grant-ssh-logs
Prefer to read the scripts before piping them to a shell? They are plain text at install.sh and service.sh, and the installation guide covers the manual path.
The chain of truth
Facts in, answers out. Nothing rewritten on the way.
Demerzel does not store a truth; it stores the evidence to rebuild the best known truth at any point in time. That is why every answer can show its work.
- AgentReads the host every minute. Outbound HTTPS only, mutual TLS.
- EvidenceEach report is stored as an immutable fact, exactly once.
- ProjectionsServer state, Health Score, vulnerabilities and incidents, rebuilt from the facts.
- ActionsWhat needs you, ranked, each tied to the facts behind it.
- YouThe dashboard, and a notification once per situation.
What the agent reads
Posture, not content. Logs only if you say so.
It never reads passwords, file contents or environment variables, opens no port and
changes nothing. Run demerzel-agent inspect to see a full report before you
enroll.
| Source | What is sent | When |
|---|---|---|
| System | CPU, memory, disk, load, uptime, OS and kernel. | Always |
| Packages | Installed versions, pending security updates, apt history. | Always |
| Services | systemd units, their state, failures and restarts. | Always |
| Sites & certificates | Virtual hosts served by nginx or Apache, and the certificates they use. | Always |
| Posture | SSH configuration, firewall rules and listening ports, automatic updates — what the checklist needs. | Always |
| Web logs | Summaries per client address: sampled paths, user agents, status codes. Never full logs. | Once you run grant-web-logs |
| SSH logins | Failed attempts per address, and the user names tried against accounts that do not exist. | Once you run grant-ssh-logs |
| fail2ban | Its Ban and Unban lines only: jail, address, action and time. | Once you run grant-fail2ban-logs |
Every grant has its revoke (revoke-web-logs, …). The full list is in the data & privacy reference.
What Demerzel keeps
Only as long as it is useful.
Hosted in Canada, on OVHcloud in Beauharnois, Québec. Everything is scoped to your organization, and permanently deleted on request.
| Raw reports from the agent | 30 days |
| Metrics | 48 hours at full resolution, hourly for 90 days, daily for 2 years |
| Sampled paths and user agents | 30 days |
| Detections, incidents, replays | 90 days |
| Blocks, fail2ban bans, fleet decisions | 1 year |
| Reachability probes | 30 days |
| Encrypted backups (OVHcloud, United Kingdom) | Up to 6 months, then they expire |
Keeping it current
Updates you can verify, when you choose.
- Signed releases. Each release ships a manifest signed with Ed25519; an agent refuses any binary it does not vouch for.
- Opt-in. Auto-update is off until you turn it on. Otherwise, one command updates on your schedule.
- Visible. The dashboard tells you which agents are behind, and the Health Score counts it.
$ sudo demerzel-agent --update # or let it keep itself current $ curl -fsSL https://get.demerzel.cloud/service.sh | sudo DEMERZEL_AUTO_UPDATE=1 sh
See it on your own server.
Two commands, one minute, and Demerzel tells you what it found.
14-day free trial · No credit card required