Built for the review your
architect will run anyway.
Where the platform runs, how tenant data and credentials are protected, and why the tier-3 hybrid model means your secrets never depend on trusting our cloud. This page summarises the architecture we walk enterprise reviewers through — a deeper technical review and the DPA are available under NDA.
Hosting & residency
EU-hosted. EU-owned. Your choice where it runs.
The managed SaaS control plane runs in AWS Ireland (eu-west-1), so your data resides in the EU. AWS is a US-owned operator, though — so where US jurisdiction has to be off the table entirely, the spectrum below runs all the way to EU-sovereign operators and your own datacenter. RapidValue itself is a Belgian company — no US parent, no extraterritorial ownership question on top of your data-residency one. One caveat we'd rather state than have you discover: only the managed SaaS option is productised today. The three "on request" options are real offers, scoped and built together with the first customer who needs them — not a switch we flip.
In every option the tier-3 agent can additionally keep connector credentials inside your network.
SaaS
AWS eu-west-1 · Ireland
Fully managed. GDPR-compliant EU data residency. Fastest to start — same-day POC.
Best for most EU mid-market
EU Sovereign SaaS
OVH / Scaleway · EU-domiciled
Same managed service on a European operator. No US Cloud Act exposure, no American legal jurisdiction over your data.
Regulated industries, Cloud Act concerns
Private Cloud
Your AWS / Azure / OVH account
We deploy and manage the platform inside your own cloud account. Your data stays in your environment.
Critical infrastructure, strict residency
On-Premises
Your own datacenter
Containerised deploy (Docker Compose). Packaged together with you for the first rollout; you operate it under your own controls.
Government, defense, strict isolation
Data protection
Encrypted in transit and at rest — keys held apart from data.
🔒 In transit
All external traffic terminates on TLS with automatically renewed certificates. The agent authenticates to the control plane with an ECDSA P-256 keypair — a signed challenge–response rather than a shared secret, and the private key never leaves your host. Outbound to your own systems, an internal CA can be added to the tenant trust store — honoured today by the REST and SCIM engines.
💾 At rest
The governance database (managed PostgreSQL) is encrypted at rest with AWS KMS. Connector secrets never sit in that database: they are held in a dedicated encrypted vault whose master key lives in a separate store from the data it protects.
🗝️ Bring your own vault
Already run HashiCorp Vault, Azure Key Vault or AWS Secrets Manager? Register it as a secret backend — RapidValue stores references, your vault keeps the values. Register as many as you need and bind them per connector. Read-only backends are supported: we can resolve secrets we can never write.
🛡️ Tier-3 custody
In agent mode the agent in your VPC resolves credentials locally — they are never transmitted to the control plane; the wire carries configuration and results, not secrets. Tunnel mode is the other trade-off, and we name it plainly: there the control plane keeps the credential and only borrows the agent's network path — every bridged request is pinned to its declared target, so the agent still can't be repurposed as a proxy.
Compromising the data store alone yields ciphertext; compromising a key store alone yields keys to nothing.
Bring Your Own Vault
Already running a corporate secret store? Connect it directly — RapidValue stores connector credentials in your vault, not ours.
The tier-3 agent
Two-layer architecture. Sharp data boundary.
The control plane handles task scheduling, configuration, dashboards, and aggregated reporting. The agent handles connector execution, raw identity data, and local secret resolution. Connector credentials never leave your network — by architecture, not policy.
🌐 Control plane (our EU cloud)
- Task scheduling + queue
- Tenant config, dashboards, audit chain
- Connector metadata (engine type, vendor template)
- Aggregated identity/grant data (post-sync, no secrets)
🏢 Agent (your VPC)
- Local encrypted credential store — resolved on the host, never uploaded
- Connector execution against your AD / LDAP / REST targets
- Sync results returned to the control plane — you choose what syncs via the wizard's attribute selection
- Signed self-update — verified before it installs, with automatic rollback
Result: you get the operational simplicity of SaaS with a sharp, enforceable data boundary. Auditors can verify that connector secrets never crossed it by reading the agent source — one Python file, ≈2,500 lines. In agent mode the agent additionally pulls our connector code down from the control plane over its authenticated channel, version-locked by content hash, so it can run connectors locally; that bundle is the same connector source that runs in our cloud, and it carries no secrets.
Side-by-side security comparison
Agent vs SSL VPN — when classic IGA reaches into your AD.
Classic IGA platforms typically deploy a virtual appliance behind a customer-managed VPN to reach AD. The VPN gets you connectivity — but it also gets you a wide-open IP tunnel between the vendor's SaaS and your internal network. Here's how the tier-3 agent compares on every security dimension that comes up in customer reviews.
Schematic. The appliance pattern as commonly deployed by classic IGA when reaching on-prem AD; specifics vary per vendor.
← swipe to compare →
| Dimension | Classic SSL VPN deployment | RapidValue tier-3 agent |
|---|---|---|
| Where connector credentials live | Vendor's SaaS Stored in the vendor's vault. Encrypted in transit + at rest on their side. Your customer security review must trust their key management, their backup process, and their breach response. |
Your machine Held in an encrypted store on the agent host, unlocked by a master key you control — a local key file, or sourced from your own secret store (Azure Key Vault / HashiCorp Vault). Never transmitted to the control plane. |
| Network ingress | Inbound permitted SSL VPN tunnel terminates inside your network. By design, the vendor's appliance can initiate connections to anything reachable from that VPN endpoint — broad blast radius. |
No inbound Agent connects outbound on port 443 to *.rapidvalue.eu.
No listening ports on the agent host. Your firewall sees one
well-known TLS destination. Nothing else. |
| Data classification reaching the SaaS | Raw, unfiltered VPN sees AD bind events, raw user attributes, password operations. Vendor's SaaS holds full identity data including sensitive fields (employee numbers, badge IDs, sometimes salaries). |
You decide what syncs The agent executes connector calls in your network and returns results to the EU control plane. What gets imported is under your control: the wizard's attribute selection decides, per object and per field, what syncs at all. Secrets resolve locally, never uploaded. |
| SSRF / arbitrary-target risk | Open by default VPN tunnel doesn't limit what the SaaS-side can ask. A compromised control plane can reach any internal service from the VPN endpoint — DBs, secret stores, internal admin panels. |
URL allowlist Every tunnelled request is pinned to the connector's own configured base URL, and the agent refuses anything that falls outside it. Closed by default, not "lock down after the fact". |
| Authentication of control plane → endpoint | VPN-level Authentication happens once (VPN handshake). After that, the tunnel is fully trusted. No per-request signing or replay protection. |
Per-session signed Agent authenticates via an ECDSA P-256 keypair and a signed challenge-response, verified against the public key it registered. Sessions are short-lived and re-established from the keypair, so there is no long-lived shared secret in play. Client-certificate pinning can be layered on top to bind an agent to one certificate. |
| Audit trail of vendor-side actions | In the vendor's hands VPN connection logs are at the vendor; any unusual action takes a ticket + their breach-response process to surface. Often discovered months after the fact. |
Local + immutable The agent logs every task it executes to its own host journal, and the outcome of every task lands in the tenant audit chain — hash-chained and immutable at the database engine itself. Verifiable from your side at any time, without vendor involvement. |
| Self-update integrity | Vendor-managed Vendor pushes appliance updates over the tunnel. Verification depends on their build pipeline + your trust in their signing process. Limited rollback options. |
Signature-verified + auto-rollback The agent verifies the signature on any update it is offered against a key it already holds before installing anything — an update that doesn't verify is refused outright. An update that then fails to start is reverted to the previous version automatically on the next start. No emergency SSH. |
| Detecting a hung agent | Silence looks like health A VPN appliance that stops working still answers ping; you find out when a sync did not land. |
It watches itself Life is a completed round trip — a heartbeat that came back, a poll that finished, empty polls included — and a half-open socket deliberately does not count. Miss the deadline it set for itself and it restarts. If it cannot, the silence is a finding with a name on it, not an empty dashboard. |
| Blast-radius caps (write operations) | None at network layer VPN doesn't know what's a "normal" provisioning rate. A misconfigured policy or compromised SaaS can mass-modify your AD before the standard IGA safety thresholds even check. |
Per-agent thresholds Provisioning thresholds (creates / updates / deletes) configured per agent boot. Once breached, the agent refuses that operation class until you investigate. Belt-and-suspenders alongside the control-plane safety guards. |
| Decommissioning | Formal teardown VPN cert revocation, firewall rule cleanup, appliance VM decommissioning, vendor-side tenant deletion. Multi-week process for a 2-week POC that didn't convert. |
One command Stop the agent service (or kill its container). It stops accepting tasks; its local credential store can be deleted; firewall rules and accounts go untouched. Walk-away clean. |
The vendor-credentials guarantee — in writing
For every connector you run in agent mode, the credential stays inside your network for the entire connector lifecycle. The control plane never receives it, never logs it, never backs it up. We encode this as a binding architectural commitment in our agreements — not a policy you have to trust. Read the agent source (≈ 2,500 lines of Python, one file) and verify yourself. Tunnel mode is the deliberate exception and we say so on the tin: there the credential lives with the control plane and the agent is only the network path.
Isolation & accountability
Tenant-scoped data model. Audit-proof by construction.
🧱 Tenant isolation
Two layers, not one. Every row carries a tenant identifier and every read and write is scoped to the caller's tenant — and that scoping is now backed by the database itself: row-level security is enabled and forced on every tenant-scoped table, and the application connects as a role that owns nothing and cannot bypass those policies, which is what makes them bite rather than decorate. The scope is transaction-local, and an unset scope returns nothing rather than everything, so a forgotten filter fails closed. Both layers are pinned by a cross-tenant regression suite that runs on every change. And above both, reads follow one permission matrix: the scope a list enforces is carried by every detail behind it — wired as a route dependency, so the next endpoint cannot forget it — and a record outside your scope answers "not found", never "forbidden", because confirming something exists is half a leak. Which roles reach which surface is pinned per router against the same matrix the interface reads. A dedicated single-tenant deployment is still scoped on request, for frameworks that require physical rather than logical separation.
⛓️ Immutable audit chain
The audit log is database-immutable (updates and deletes are rejected by the engine itself) and hash-chained — records carry a cryptographic link to their predecessor, so tampering is detectable, and the chain is verifiable through the API. Exported evidence is signed on the way out: both the raw audit-log export and the evidence packs your auditor receives carry an HMAC-SHA256 signature, and a pack additionally hashes every file inside it, so a tampered pack fails verification. Every pack is in fact signed twice over the same bytes. The HMAC is ours. The second signature is ECDSA P-256 with a per-tenant key whose public half we hand out — so your auditor verifies the pack without us, with a verifier that ships inside the pack itself: a standalone script, signed along with the data it checks, that imports nothing from our platform. Your auditor unzips, runs it against the published public key, and needs nothing further from us. Strip the second signature and the first one notices, because it is declared inside the manifest it signs.
🇪🇺 GDPR, operationalised
Right-to-erasure (Art. 17) is a built-in pseudonymisation flow: identity and account PII is overwritten with a stable pseudonym and the login is deleted, while audit events, grants and requests are deliberately retained under Art. 17(3)(b). Portability (Art. 20) is a self-service per-tenant export — every table as JSONL, audit history included, behind a 24-hour signed link. Deleting a tenant outright needs a typed confirmation and a 30-day offboarding window before it can execute at all.
🔑 Your IdP, your session rules
Sign in to RapidValue through your own identity provider (OIDC or SAML 2.0, service-provider-initiated), enforce MFA and a per-tenant password policy — and deactivating an admin kills their sessions instantly, not at token expiry. Machine access uses scoped API credentials: the secret is shown once, stored only as a hash, and every call is checked against its scopes. Every sign-in, reset and revocation lands in the immutable audit trail.
🚦 Deploy safety
Releases pass a deep health gate — schema drift or an unhealthy database fails the deployment loudly instead of serving a degraded platform. The new version boots, migrates and passes its health gate while the old one is still serving; the proxy flips only after that, and only then does the old one stop. Every gate sits before the flip, so a failed release means nothing happened. Measured: 462 requests through a live swap, zero non-2xx. A rollback runs the same script — it cannot land on a colour the proxy is not pointing at. Backups run per tier with independent lifecycle policies.
🪞 The platform governs itself
Your admins are governed identities: platform roles are group memberships, every role assignment is a grant that shows up in reconciliation and access reviews like any other — and guardrails ensure automation can never strip your last admin.
This page is the posture. Underneath it sits a detailed security-architecture document — key custody, agent authentication and update integrity, the isolation model, and the limitations we would rather name ourselves than have you find. We share it under NDA and walk your architect through it live, because the questions it raises deserve an engineer on the call, not a download link.
This site itself: static pages, no cookies, cookieless EU-hosted analytics (Plausible) — no cross-site tracking, no personal identifiers.