What can stay local
In agent mode, connector credentials are looked up on the agent host and are never sent to the control plane. The agent only makes outbound connections.
Trust & architecture
Where RapidValue runs
and what data leaves your network
RapidValue runs its managed service at Scaleway, a French cloud provider, in its Amsterdam region. If you want, a small agent runs the connectors inside your own environment and keeps the credentials there. The agent only makes outbound HTTPS connections.
Tier-3 hybrid architecture
A managed service that can reach your internal systems, while credentials stay with you
The control plane runs the identity model, governance, dashboards, decisions and evidence. A small agent can reach private systems and looks up connector credentials inside your environment.
Belgian-founded · EU control planeOutbound HTTPS :443 onlyECDSA P-256 agent identityNo decommissioning project if you leave
What runs whereOne governance service, and you choose where connectors runChoose managed or agent mode for each connector.
Inside your networkYour environment
Tier-3 agentRuns connector code and reaches private systems
Local or external vaultCredentials are looked up here and stay out of our SaaS
ADLDAPHRApps
Results + selected identity data →← Tasks + signed configurationOutbound HTTPS :443No inbound portsSecrets stay in your network
EU data region · managed cloudEU control plane
Identity modelIdentities · accounts · entitlements · grants
Governance and decisionsPolicies · reviews · risk · reconciliation
EvidenceDashboards · audit packs · unchangeable history
Connectors for internet-facing SaaS applications can run in the control plane. Use agent mode when network access or credentials have to stay inside your environment.
What stays and what leaves
Credentials can stay with you. Identity data goes to the EU control plane.
What governance needs
The identity data you select (identities, accounts, entitlements and grants) goes to the EU control plane. Reconciliation, risk, reviews and evidence run there.
Bring your own vault
You can use HashiCorp Vault, Azure Key Vault or AWS Secrets Manager. RapidValue stores a reference, and your vault keeps the secret.
Hosting & residency
One product with three ways to host it
By default RapidValue is a managed service at Scaleway, in its Amsterdam region in the EU. If your architecture or policy requires infrastructure you control, it can run in your own cloud account or on-premises.
European cloud, by default
Scaleway · Amsterdam · backups in ParisRapidValue’s managed service runs at Scaleway, a French cloud provider, in Amsterdam. Backups are kept in a second region, Paris. European hosting is part of the standard service. You do not need a premium tier or a special configuration for it.
Included in RapidValue from day oneCustomer-managed cloud
Your cloud account · designed togetherRun RapidValue inside your own cloud account when your security architecture or procurement policy requires infrastructure you control.
For customer-controlled infrastructure and operationsOn-premises
Your datacenter · designed togetherDeploy RapidValue in your own datacenter when you have strict isolation, residency or infrastructure-control requirements.
For strict isolation and datacenter controlControls in daily operation
Six controls you can inspect in the running product
An architecture diagram only helps if the same boundaries hold in daily operation. A security review can inspect these six controls in the running product.
Decision record11:42
- Decision
- Access removed
- Identity
- Jan Peeters
- System
- Entra ID
- Reason
- HR end date
- Decided by
- Leaver policy
- Confirmed
- On target · 31 Aug
Recorded. A later edit would show.
Tenant isolation
Tenant context is enforced through the application and backed by database controls.
Data minimisation
You choose which objects and attributes enter the governance model.
Evidence that cannot be changed
Audit history is hash-chained, and signed exports make tampering detectable.
Platform access
SSO, MFA, scoped API credentials and governed admin roles protect RapidValue itself.
Operational safety
An engine pause and safety limits stop unexpected automation and record the reason.
Data-subject workflows
Export and erasure support GDPR Articles 20 and 17, with a stated limit for legal retention.
Send us your security questions