No raw span in a log macro
In any build profile, including debug.
Transport and storage
The no-fallback rule is a build gate, not a policy.
A static check runs on every commit and fails if a non-TLS transport path is introduced. Fallbacks scaffolded for convenience in development are how production ends up with one.
| Property | Implementation |
|---|---|
| Agent to server transport | Mutual TLS, with client certificates per device |
| HTTP fallback | None. Not in production, and not in local development, which uses a dev CA |
| Local event buffer | Encrypted at rest, even though the contents are already redacted |
| Tenant identity | Derived from the certificate chain and verified server-side: never from a client-supplied field |
| Event store | Append-only |
Privacy invariants in CI
A rule that depends on reviewer vigilance is a rule that eventually fails.
No unmasked serialisable field
On any event struct.
No non-TLS transport path
Anywhere in the tree.
Cross-tenant isolation
Executable tests, not a design claim.
Book a demo
See it stop a real one.
Forty-five minutes on your own data, run by one of our engineers. Bring something you would not want leaving the building.
Book a technical demoAgent integrity and tenancy
Removal is reported, not merely observed.
The agent checksum-verifies its own binary and refuses to run if it or the extension has been tampered with. A device transitions to a visible uncovered state in the console rather than simply going quiet, which matters, because silent gaps are the failure mode this product exists to avoid.
One backend serves many organisations, with tenant isolation as a second boundary alongside the raw-content one: identity from the mTLS chain, separate per-tenant keys, policy and configuration, and residency routing. Cross-tenant invariants are tested on every change.
Supply chain: signed and notarised installers per platform, reproducible builds, a signed update channel, and dependency review. Extension updates ship through the managed browser policy channel rather than the public store, so what your fleet runs is what you approved.
Compliance status
Written honestly, or not at all.
We hold no third-party certification today, and we are not going to imply one. When an audit is underway this section will name it and the stage it has reached, “SOC 2 Type II in progress, report expected Q3” is a better sentence than a badge. Security buyers check, and one overstated claim here costs more than the deal it was meant to win. Ask and you will get the current position.
Vulnerability reports go to the address in security.txt. We do not pursue good-faith researchers who follow coordinated disclosure.
Keep reading
How the rest of it is built and run.
- Architecture Privacy architecture Itzal runs detection on the endpoint and transmits only a redacted event record. Read the page
- Product Deployment Signed installers through Intune, Jamf, Kandji or Ansible, browser extension by policy. Product page
- SOC 2 SOC 2 and AI tools AI tools are a vendor question and a confidentiality question at once. What an auditor asks, and which controls the answers sit under. 6 min read
- Product Admin console Findings by framework, an incidents queue, policy per framework and per department, and coverage health per device. Product page