Built for the review your
architect will run anyway.
Where the platform runs, how tenant data and credentials are protected, and why the tier-3 hybrid model means your secrets never depend on trusting our cloud. This page summarises the architecture we walk enterprise reviewers through — a deeper technical review and the DPA are available under NDA.
Hosting & residency
EU-hosted. EU-owned. Your choice where it runs.
The managed SaaS control plane runs in AWS Ireland (eu-west-1), so your data resides in the EU. AWS is a US-owned operator, though — so where US jurisdiction has to be off the table entirely, the spectrum below runs all the way to EU-sovereign operators and your own datacenter. RapidValue itself is a Belgian company — no US parent, no extraterritorial ownership question on top of your data-residency one.
In every option the tier-3 agent can additionally keep connector credentials inside your network.
SaaS
AWS eu-west-1 · Ireland
Fully managed. GDPR-compliant EU data residency. Fastest to start — same-day POC.
Best for most EU mid-market
EU Sovereign SaaS
OVH / Scaleway · EU-domiciled
Same managed service on a European operator. No US Cloud Act exposure, no American legal jurisdiction over your data.
Regulated industries, Cloud Act concerns
Private Cloud
Your AWS / Azure / OVH account
We deploy and manage the platform inside your own cloud account. Your data stays in your environment.
Critical infrastructure, strict residency
On-Premises
Your own datacenter
Docker Compose (containerised deploy). You deploy and operate, under your own controls.
Government, defense, strict isolation
Data protection
Encrypted in transit and at rest — keys held apart from data.
🔒 In transit
All external traffic terminates on TLS with automatically renewed certificates. The agent authenticates to the control plane with an ECDSA P-256 challenge–response — a leaked token alone cannot bootstrap a session.
💾 At rest
The governance database (managed PostgreSQL) is encrypted at rest with AWS KMS. Connector secrets live in an authenticated-encryption vault whose master key is stored separately from the data it protects.
🗝️ Bring your own vault
Already run HashiCorp Vault, Azure Key Vault or AWS Secrets Manager? Register it as a secret backend — RapidValue stores references, your vault keeps the values. Read-only backends are supported: we can resolve secrets we can never write.
🛡️ Tier-3 custody
For on-prem systems the agent in your VPC resolves credentials locally — they are never transmitted to the control plane. The wire carries configuration, not secrets, and every bridged request is pinned to its declared target so the agent can't be repurposed as a proxy.
Compromising the data store alone yields ciphertext; compromising a key store alone yields keys to nothing.
Bring Your Own Vault
Already running a corporate secret store? Connect it directly — RapidValue stores connector credentials in your vault, not ours.
The tier-3 agent
Two-layer architecture. Sharp data boundary.
The control plane handles task scheduling, configuration, dashboards, and aggregated reporting. The agent handles connector execution, raw identity data, and local secret resolution. Connector credentials never leave your network — by architecture, not policy.
🌐 Control plane (our EU cloud)
- Task scheduling + queue
- Tenant config, dashboards, audit chain
- Connector metadata (engine type, vendor template)
- Aggregated identity/grant data (post-sync, no secrets)
🏢 Agent (your VPC)
- Local
agent-vault.json— encrypted credentials - Connector execution against your AD / LDAP / REST targets
- Sync results returned to the control plane — you choose what syncs via the wizard's attribute selection
- HMAC-signed self-update with automatic rollback
Result: you get the operational simplicity of SaaS with a sharp, enforceable data boundary. Auditors can verify that connector secrets never crossed it by reading the agent source — a single Python file.
Side-by-side security comparison
Agent vs SSL VPN — when classic IGA reaches into your AD.
Classic IGA platforms typically deploy a virtual appliance behind a customer-managed VPN to reach AD. The VPN gets you connectivity — but it also gets you a wide-open IP tunnel between the vendor's SaaS and your internal network. Here's how the tier-3 agent compares on every security dimension that comes up in customer reviews.
Schematic. The appliance pattern as commonly deployed by classic IGA when reaching on-prem AD; specifics vary per vendor.
← swipe to compare →
| Dimension | Classic SSL VPN deployment | RapidValue tier-3 agent |
|---|---|---|
| Where connector credentials live | Vendor's SaaS Stored in the vendor's vault. Encrypted in transit + at rest on their side. Your customer security review must trust their key management, their backup process, and their breach response. |
Your machine Stored in agent-vault.json on the agent host.
Encrypted with a local master key (env var, local key file,
or your own secret store — Azure Key Vault / HashiCorp Vault).
Never transmitted to the control plane. |
| Network ingress | Inbound permitted SSL VPN tunnel terminates inside your network. By design, the vendor's appliance can initiate connections to anything reachable from that VPN endpoint — broad blast radius. |
No inbound Agent connects outbound on port 443 to *.rapidvalue.eu.
No listening ports on the agent host. Your firewall sees one
well-known TLS destination. Nothing else. |
| Data classification reaching the SaaS | Raw, unfiltered VPN sees AD bind events, raw user attributes, password operations. Vendor's SaaS holds full identity data including sensitive fields (employee numbers, badge IDs, sometimes salaries). |
You decide what syncs The agent executes connector calls in your network and returns results to the EU control plane. What gets imported is under your control: the wizard's attribute selection decides, per object and per field, what syncs at all. Secrets resolve locally, never uploaded. |
| SSRF / arbitrary-target risk | Open by default VPN tunnel doesn't limit what the SaaS-side can ask. A compromised control plane can reach any internal service from the VPN endpoint — DBs, secret stores, internal admin panels. |
URL allowlist Every tunnelled HTTP request from the control plane carries allowed_base_url = the configured connector base URL.
Agent refuses any URL that doesn't match. Closed by default,
not "lock down after the fact". |
| Authentication of control plane → endpoint | VPN-level Authentication happens once (VPN handshake). After that, the tunnel is fully trusted. No per-request signing or replay protection. |
Per-session signed Agent authenticates via ECDSA P-256 keypair + challenge-response. Short-lived 4-hour JWT access tokens. Nonces are one-time, verified against agent's registered public key. Optional mTLS layered on top. |
| Audit trail of vendor-side actions | In the vendor's hands VPN connection logs are at the vendor; any unusual action takes a ticket + their breach-response process to surface. Often discovered months after the fact. |
Local + immutable Every connector call is logged on the agent host and reported back to the audit chain (HMAC-signed, PostgreSQL-trigger-immutable). Verify from your side at any time without vendor involvement. |
| Self-update integrity | Vendor-managed Vendor pushes appliance updates over the tunnel. Verification depends on their build pipeline + your trust in their signing process. Limited rollback options. |
HMAC-verified + auto-rollback Each release is HMAC-SHA256 signed with a per-agent key. Agent verifies before swapping. Failed boot within 60s restores previous binary automatically. No emergency SSH required. |
| Blast-radius caps (write operations) | None at network layer VPN doesn't know what's a "normal" provisioning rate. A misconfigured policy or compromised SaaS can mass-modify your AD before the standard IGA safety thresholds even check. |
Per-agent thresholds Provisioning thresholds (creates / updates / deletes) configured per agent boot. Once breached, the agent refuses that operation class until you investigate. Belt-and-suspenders alongside the control-plane safety guards. |
| Decommissioning | Formal teardown VPN cert revocation, firewall rule cleanup, appliance VM decommissioning, vendor-side tenant deletion. Multi-week process for a 2-week POC that didn't convert. |
One commandsystemctl stop rv-agent (or kill the Docker container).
Agent stops accepting tasks; vault file can be deleted; firewall
rules and accounts go untouched. Walk-away clean. |
The vendor-credentials guarantee — in writing
Connector credentials handled by the tier-3 agent stay inside your network for the entire connector lifecycle. The control plane never receives them, never logs them, never backs them up. We encode this as a binding architectural commitment in our agreements — not a policy you have to trust. Read the agent source (≈ 1,500 lines of Python, one file) and verify yourself.
Isolation & accountability
Tenant-scoped data model. Audit-proof by construction.
🧱 Tenant isolation
Every row carries a tenant identifier and every query is tenant-scoped by construction — cross-tenant access is structurally impossible through the API. Dedicated single-tenant deployment available for stricter requirements.
⛓️ Immutable audit chain
The audit log is database-immutable (updates and deletes are rejected by the engine itself) and hash-chained — every record carries a cryptographic link to its predecessor, so tampering is detectable, and exports are signed.
🇪🇺 GDPR, operationalised
Right-to-erasure (Art. 17) is a built-in pseudonymisation flow that preserves the compliance-mandated audit history; data portability (Art. 20) is a per-tenant export producing a complete, machine-readable copy of your data.
🔑 Your IdP, your session rules
Sign in to RapidValue through your own identity provider, enforce MFA and a per-tenant password policy — and deactivating an admin kills their sessions instantly, not at token expiry. Every sign-in, reset and revocation lands in the immutable audit trail.
🚦 Deploy safety
Releases pass a deep health gate — schema drift or an unhealthy database fails the deployment loudly instead of serving a degraded platform. Backups run per tier with independent lifecycle policies.
🪞 The platform governs itself
Your admins are governed identities: platform roles are group memberships, every role assignment is a grant that shows up in reconciliation and access reviews like any other — and guardrails ensure automation can never strip your last admin.
This site itself: static pages, no cookies, cookieless EU-hosted analytics (Plausible) — no cross-site tracking, no personal identifiers.