Security & trust
Built to earn the access it asks for.
Demerzel sits on your servers, so every boundary is one you can check yourself — not a promise you have to take on trust.
An agent that only reads
It opens no inbound port, changes nothing on the host, and takes no command from Demerzel. It reads and it reports — nothing more.
Every byte it sends, on display
demerzel-agent inspect prints exactly what a live run would send, and sends nothing; transmissions lists what was actually sent. A test fails our build if the two ever drift apart.
It reports posture, not content
Metrics, package versions, services, certificates and domains. From logs, only what a detection needs — sampled paths, user agents, and the user names tried against accounts that do not exist. Never passwords, file contents or environment variables.
Mutual TLS, per agent
Each agent enrolls once, with a short-lived enrollment token, and gets its own certificate. Its identity comes from that certificate, never from what it sends. Certificates renew on their own.
Signed, opt-in updates
Releases are signed with Ed25519, and an agent refuses any binary the signed manifest does not vouch for. Auto-update is off until you turn it on.
Blocking lives elsewhere
Active Defense is done by the warden: a separate program with no network, a policy only root can write, and nft as its only tool. Fleet decisions reach it only if signed by a key root explicitly trusted on that host.
Canadian hosting
Hosted in Canada, on OVHcloud in Beauharnois, Québec, encrypted in transit. Encrypted backups sit on a separate OVHcloud server in the United Kingdom. Two services see some of your data: Mailgun (United States) delivers our emails, alerts included, and Manifest monitors the outbound calls our backend makes. Our website analytics never see it.
Bounded retention
Raw reports are kept 30 days, security evidence 30 to 90 days, enforcement records a year. Metrics are downsampled as they age. Your data is permanently deleted on request, and leaves our encrypted backups as they expire, within six months.
Isolation, roles and an audit trail
Every query is scoped to one organization. Owner, admin and read-only roles are enforced server-side, every change is in the activity log, and you can sign in with a passkey.
Full technical detail lives in the security documentation.
Put it in front of your security review.
Run inspect before you enroll. Read what it would send. Then decide.
14-day free trial · No credit card required