The boundary
The agent opens outbound connections only and listens on no port. Approval releases a signed trigger to your own pipeline, which executes it. The signing key never leaves your approver.
Limitations
Connection model
Outbound only. The agent runs on your hosts and opens outbound connections only. It listens on no port. You open no inbound firewall rule for us.
Credentials
None held. The controller holds no credentials for your hosts. It has no SSH keys and no accounts on your infrastructure. There is no path by which it could log in.
Change control
Human-signed. LPaC does not apply changes to your infrastructure. An approval releases a signed trigger to your own deployment pipeline, which executes it. Every release requires a person to trigger it.
Tenancy
Isolated. Each client runs in an isolated tenancy. Nothing is shared between clients, and nothing of yours is pooled.
Evidence
Checkable. Divergences, approvals and outcomes are recorded as signed, hash-chained entries. Each entry can be verified independently.
Signing keys
Yours. The approval key is generated and held by your approver. LPaC receives the public key only, so a valid signature can only have come from your side.
Q&A
What data leaves our hosts?
Configuration and timing readings collected by the agent, sent outbound over TLS to the controller in your tenancy. Market data and order flow are not read and not collected.
Can LPaC change anything on its own?
No. LPaC proposes; it does not apply. An approval releases a signed trigger to your own deployment pipeline, and a person triggers every release. The rollback is authorised at the same moment, as policy, and your pipeline executes that too.
What do you store, and where?
The declared posture, divergence records and the signed evidence chain, held in your tenancy. Nothing is pooled across clients.
How is the evidence verified?
Each record is hash-chained and signed under the key your approver holds. Verification needs the record and the public key; it does not need LPaC.
What happens if we stop using it?
The agent uninstalls like any package. The posture definitions and the evidence are yours and remain usable; there is nothing of yours we keep.
How do we report a security concern?
The site publishes a security.txt with a monitored contact. Reports are acknowledged and handled directly by the engineering team.