Self-hosted in your cloud
Greenlight installs into Azure, GCP, or AWS using a versioned provider package. Your data and end users stay inside the cloud boundary your team controls.
Security posture
For security reviewers
Greenlight is self-hosted in your Azure subscription, Google Cloud project, or AWS account, authenticated through your identity provider, and runs on infrastructure your team controls. It gives IT a continuous, auditable governance plane over the apps your employees build with coding agents.
At a glance
Section titled “At a glance”Authenticated by your IdP
OIDC SSO integrates with Entra ID, Okta, and Google Workspace today. SAML and SCIM are coming soon.
Every change is reviewed
Apps are delivered through pull requests, and every pull request runs through a single Greenlight policy check that covers committed secrets, dependency vulnerabilities, and your org policy bundle.
Every action is audited
An append-only audit log records platform, agent, and IT actions. Search, export, SIEM forwarding, and tamper-evident chaining are on the roadmap.
The seven things buyers ask
Section titled “The seven things buyers ask”Where does our data live?
Section titled “Where does our data live?”In your Azure subscription, Google Cloud project, or AWS account, behind the network boundary created for Greenlight. The control plane, data broker, and deployed apps run together inside that boundary. See Network isolation.
Who has admin access?
Section titled “Who has admin access?”Whoever your identity provider says maps to the org_admin role. Greenlight has no superuser account, no recovery key for Shift staff, and no shadow directory of its own. See Identity, SSO & RBAC.
How are secrets stored?
Section titled “How are secrets stored?”Integration credentials and sensitive environment variables sit in your cloud’s managed secret store—Key Vault, Secret Manager, or Secrets Manager—never in the control-plane database. Apps authenticate using workload identity rather than static cloud credentials. Admins can see that a secret exists; they cannot read its value. See Secrets management.
What’s the audit story?
Section titled “What’s the audit story?”Every platform, agent, and IT action emits an audit event with actor, target, diff, and reason. The log is append-only today. Audit search, CSV/JSON export, SIEM forwarding, WORM storage, and HMAC chaining are coming soon. See Observability & audit.
What attack surface does Greenlight add?
Section titled “What attack surface does Greenlight add?”The control plane is a small set of HTTP services your IT team operates inside your cloud. The data broker proxies outbound calls but does not hold plaintext credentials beyond the in-memory exchange window. A full breakdown of actors, trust boundaries, and scenarios lives in Threat model.
Is Greenlight SOC 2 or HIPAA?
Section titled “Is Greenlight SOC 2 or HIPAA?”Greenlight is built to integrate cleanly with the compliance frameworks your organization already operates under. The platform’s role is to produce governance evidence inside the customer-owned install; certifications belong to the operating organization. Formal compliance packets are coming soon. See Compliance.
What happens if Greenlight goes down?
Section titled “What happens if Greenlight goes down?”Running apps continue to run. They have their own pods, their own data, and the data broker keeps serving cached integration metadata through a typical control-plane outage. New deployments and policy changes pause until the control plane recovers, and killing an app remains possible via the cloud provider’s normal Kubernetes controls even with Greenlight offline.
Identity, SSO & RBACOIDC SSO, RBAC, workload identity, and upcoming SAML/SCIM support.
Network isolationNamespaces and NetworkPolicy — what is enforced today, and what is not yet.
Secrets managementManaged secret storage, workload identity, and no plaintext in the control-plane database.
Observability & auditThe evidence trail your auditors will ask for.
Threat modelActors, boundaries, and scenarios.
ComplianceWhat the current evidence model supports, and what is coming soon.