Skip to main content
This section consolidates frequently asked questions about ResolveAI’s data security and compliance practices.

​
Security Certifications

ResolveAI is SOC2 Type 2, HIPAA, and GDPR compliant. Visit the Trust Center to request more details.

​
Overview

ResolveAI is designed with a security-first approach:
  • Read-only access to observability data by default
  • Human approval required before any write operation (alert silencing, PR creation)
  • Redaction of sensitive information
  • Customer-specific data isolation
  • SOC 2 compliance and ongoing audits
  • Strong encryption and SSO support

​
Data Access and Permissions

Q: What data does ResolveAI access in customer environments? ResolveAI accesses observability data (logs, metrics, traces, alerts, dashboards) and change events (deployments, feature flags, commits) to investigate incidents. By default, it uses read-only credentials scoped to the minimum required datasets. Q: Does ResolveAI need production write permissions? By default, no — ResolveAI uses read-only access to observability platforms (ex. Datadog, Grafana, Tempo, Sentry, New Relic) for investigations. Three optional features use write permissions when explicitly enabled by your organization:
  • Mitigation Actions: Allows Resolve to propose alert silences or downtimes during investigations. Write permissions are used only to create or remove silences after a human explicitly approves the action.
  • Git Code Remediation: Allows Resolve to propose pull requests with suggested fixes. PRs are created only after a human explicitly approves, and still require manual review and merge.
  • GitHub Actions workflow tools (in Preview): Allows Resolve to dispatch, retry, and cancel GitHub Actions workflow runs, such as deployments and rollbacks. The GitHub App requires Actions: Read & write, but access is controlled by your admins in the Resolve UI: each tool is enabled independently, defaults to requiring human approval, and can be set to run under per-user authentication rather than shared credentials. Which workflows are reachable at all is set by the repositories you include in the app installation.
In every case, the AI model that generates proposals never has direct access to write APIs. Proposals are evaluated by the AI, but execution happens through a separate engine. All write actions are fully auditable. Alert silencing and pull-request creation always require explicit human approval. GitHub Actions workflow tools also default to approval, and an admin can opt an individual tool into automatic execution, see App for GitHub. See Mitigation Actions for details on the safety model. Q: How are permissions managed? All integrations use customer-provided credentials (API keys, OAuth, or service accounts). Credentials are scoped by the customer and can be revoked at any time, leaving customers in total control of what Resolve can access. For investigation, all permissions are read-only. If your organization enables Mitigation Actions, Git Code Remediation, or GitHub Actions workflow tools, you choose which integrations to upgrade with write permissions. Write operations require explicit human approval by default, and for GitHub Actions tools an admin can choose to let a specific tool run automatically.

​
Data Handling & Privacy

Q: What data is stored? ResolveAI stores only the minimum data needed for investigations. Raw telemetry (logs, traces, metrics) is queried live and not retained. Summaries and metadata may be cached for investigation continuity, stored securely in customer-specific environments. Q: Does ResolveAI redact sensitive data? Yes. ResolveAI applies regex-based redaction for sensitive fields (PII, secrets, tokens). Customers can configure additional patterns. In deployments with the Resolve satellite, sensitive span attributes are automatically stripped before leaving the customer’s environment. Q: Is data shared across customers? No. Customer data is siloed. Learning signals from investigations (ex. improving log parsing prompts) are generalized and stripped of sensitive information before reuse.

​
Deployment & Infrastructure

Q: How is ResolveAI deployed? ResolveAI offers:
  • Cloud-hosted SaaS
  • Satellite (containerized agent) deployed in customer clusters to access local telemetry, enforce data redaction, and proxy observability queries securely.
Q: How does the satellite handle data? The satellite:
  • Scrapes Kubernetes APIs and DNS Tap.
  • Proxies queries to observability backends.
  • Applies redaction policies before transmitting data to ResolveAI’s cloud.
Q: What happens if the satellite is misconfigured? Satellites and scraping integrations require explicit environment configuration (prod, staging, etc.). Misconfigured integrations fail creation rather than defaulting to a non-existent “default” environment.

​
Security Controls

Q: Is data encrypted at rest? Yes, with AES-256 encryption. Q: Is data encrypted in transit? Yes. All traffic between customer environments, ResolveAI satellite, and ResolveAI cloud uses TLS 1.2+. Q: Does ResolveAI support SSO? Yes. ResolveAI supports SAML and OIDC-based SSO for customer users.

​
Customer Responsibilities

Q: What should customers do to ensure security?
  • Scope API keys to the minimum required permissions — read-only for investigation, and write permissions only for integrations where you have enabled Mitigation Actions, Git Code Remediation, or GitHub Actions workflow tools.
  • Configure redaction rules for PII/secrets.
  • Regularly audit and rotate credentials.
  • Set up SSO for user authentication.
  • Verify satellite environment configuration.
  • Review the Mitigation Activity dashboard to audit all write actions taken through Resolve.