solutions --enterprise
The audited broker your security team will sign off on.
SSO, data residency, privacy-first AI, SIEM streaming and a tamper-evident audit trail — the controls and evidence enterprise security and compliance teams require, with bring-your-own-Vault sync and, on a self-hosted deployment, an envelope-encryption master key sealed under an HSM-backed Vault Transit key you hold.
Enterprise terms, SSO and data residency are arranged with our team.
What changes
Evidence, not assertions
A tamper-evident audit trail, and session recordings your owners and admins can replay and keep for as long as you set, give security and compliance teams the record they actually ask for. Every replay is itself on the audit trail.
Keep data on your terms
Data residency and privacy-first AI mean sensitive output and credentials stay where policy requires.
Fits your identity stack
SSO / SAML and SCIM provisioning connect Kutrion to the directory you already run.
Plugs into your security stack
Stream security events to Splunk and Microsoft Sentinel in real time, sync credentials with your own HashiCorp Vault, and — on a self-hosted deployment — seal its envelope-encryption master key under an HSM-backed Vault Transit key of your own.
What you can do
- SSO / SAML and SCIM provisioning
- On-prem & air-gapped self-hosting
- Data residency and self-hosted AI
- SIEM streaming (Splunk, Sentinel) and webhook alerts
- Bring-your-own HashiCorp Vault sync, and on self-hosted an HSM-backed master key you hold
- SOC 2 trajectory, DPA and subprocessors
- Dedicated onboarding and support
faq --list
For enterprise — questions
Do you support SSO and provisioning?
Yes — SSO / SAML for sign-in and SCIM for provisioning are part of the enterprise plan, alongside per-organization identity configuration.
Can you stream events to our SIEM?
Yes. The integrations hub forwards security events in real time to Splunk (HTTP Event Collector) and Microsoft Sentinel (Log Analytics), alongside Slack, PagerDuty and generic webhooks. A pull Events API is also available for full-stream and historical export.
Can we use our own HashiCorp Vault and keys?
Vault sync, yes on either deployment. The keys, on a self-hosted install. Enterprise syncs Kutrion credentials with your own HashiCorp Vault (KV v2, push / pull / bidirectional with conflict detection) whether you are hosted with us or self-hosted. The keys are a separate question, because Kutrion has one envelope-encryption master key per deployment and every data key in that deployment is wrapped by it — so who holds it turns on who runs the deployment, not on which plan you are on. Self-hosted, you do: point KEY_PROVIDER at your own HashiCorp Vault Transit key, which can itself be HSM- or auto-unseal-backed, and the master is unsealed only in memory at boot. On the hosted service that master is the deployment's own, so an Enterprise plan there does not give your organization a separate key that no other tenant's data sits under; per-organization keying is not something we offer today.
Can terminal output be kept off the cloud entirely?
Yes, and that is the default. AI runs against a self-hosted model, and cloud assist requires a per-organization opt-in that is off until an admin turns it on. Leave it off and terminal output does not reach a cloud model. To keep it on your own network as well, self-host Kutrion or point AI at your own endpoint.
Can we run Kutrion on our own hardware or air-gapped?
Yes. Kutrion self-hosts as a single Docker Compose unit and supports fully air-gapped install via an offline bundle — the signed license verifies locally with no phone-home. You can bind the master key to your hardware and seal it under your own HashiCorp Vault or HSM. See the self-hosting page for the full picture.
What compliance materials are available?
A DPA and subprocessors list are published, with a SOC 2 trajectory. Talk to us for the current status and any specific evidence your review needs.
The audited broker your security team will sign off on.
Enterprise terms, SSO and data residency are arranged with our team.