SECURITY & DEPLOYMENT

Choose who operates your execution data.

Self-host Actae inside your boundary, or use a dedicated managed runtime in the Cloud. The deployment choice changes operational responsibility, not the execution model.

An explicit data boundary

Self-hosted data remains in your PostgreSQL. Actae Cloud stores each customer's events and state in a dedicated runtime and persistent volume.

Control plane separated from payloads

The portal stores accounts, entitlement, lifecycle, and aggregate usage. It does not receive event payloads merely to meter usage.

Raw keys are shown once

Installation API keys are encrypted until first acknowledgement, then retained hash-only. Revocation propagates on sync.

TLS and optional mTLS

Production supports TLS and an opt-in mutual-TLS hardening tier. Anonymous access is disabled by default.

Auditable administration

Authentication and key operations are audit logged; subscription enforcement is applied consistently to HTTP and WebSocket access.

SECURITY TRUTH

Clear boundaries, no security theater.

  • Dedicated container, network, secrets, and volume per Cloud installation
  • TLS endpoint and authenticated API/dashboard access
  • Encrypted off-host backups with restore verification
  • Single-node PostgreSQL PITR tooling; no HA or public SLA yet
  • Self-hosted execution payloads are not uploaded to the control plane
  • Independent security review and compliance certification remain pending
  • Account export and deletion controls