Skip to main content
This section consolidates frequently asked questions about ResolveAI’s data security and compliance practices.

​
Security Certifications

ResolveAI is SOC2 Type 2, HIPAA, and GDPR compliant. Visit the Trust Center to request more details.

​
Overview

ResolveAI is designed with a security-first approach:
  • Read-only access to observability data by default
  • Human approval required before any write operation (alert silencing, PR creation)
  • Redaction of sensitive information
  • Customer-specific data isolation
  • SOC 2 compliance and ongoing audits
  • Strong encryption and SSO support

​
Data Access and Permissions

Q: What data does ResolveAI access in customer environments? ResolveAI accesses observability data (logs, metrics, traces, alerts, dashboards) and change events (deployments, feature flags, commits) to investigate incidents. By default, it uses read-only credentials scoped to the minimum required datasets. Q: Does ResolveAI need production write permissions? By default, no — ResolveAI uses read-only access to observability platforms (ex. Datadog, Grafana, Tempo, Sentry, New Relic) for investigations. Two optional features use write permissions when explicitly enabled by your organization:
  • Mitigation Actions: Allows Resolve to propose alert silences or downtimes during investigations. Write permissions are used only to create or remove silences after a human explicitly approves the action.
  • Git Code Remediation: Allows Resolve to propose pull requests with suggested fixes. PRs are created only after a human explicitly approves, and still require manual review and merge.
In both cases, the AI model that generates proposals never has direct access to write APIs. Proposals are evaluated by the AI, but execution only happens through a separate engine after human approval. All write actions are fully auditable. See Mitigation Actions for details on the safety model. Q: How are permissions managed? All integrations use customer-provided credentials (API keys, OAuth, or service accounts). Credentials are scoped by the customer and can be revoked at any time, leaving customers in total control of what Resolve can access. For investigation, all permissions are read-only. If your organization enables Mitigation Actions or Git Code Remediation, you choose which integrations to upgrade with write permissions — and every write operation requires explicit human approval before execution.

​
Data Handling & Privacy

Q: What data is stored? ResolveAI stores only the minimum data needed for investigations. Raw telemetry (logs, traces, metrics) is queried live and not retained. Summaries and metadata may be cached for investigation continuity, stored securely in customer-specific environments. Q: Does ResolveAI redact sensitive data? Yes. ResolveAI applies regex-based redaction for sensitive fields (PII, secrets, tokens). Customers can configure additional patterns. In deployments with the Resolve satellite, sensitive span attributes are automatically stripped before leaving the customer’s environment. Q: Is data shared across customers? No. Customer data is siloed. Learning signals from investigations (ex. improving log parsing prompts) are generalized and stripped of sensitive information before reuse.

​
Deployment & Infrastructure

Q: How is ResolveAI deployed? ResolveAI offers:
  • Cloud-hosted SaaS
  • Satellite (containerized agent) deployed in customer clusters to access local telemetry, enforce data redaction, and proxy observability queries securely.
Q: How does the satellite handle data? The satellite:
  • Scrapes Kubernetes APIs and DNS Tap.
  • Proxies queries to observability backends.
  • Applies redaction policies before transmitting data to ResolveAI’s cloud.
Q: What happens if the satellite is misconfigured? Satellites and scraping integrations require explicit environment configuration (prod, staging, etc.). Misconfigured integrations fail creation rather than defaulting to a non-existent “default” environment.

​
Security Controls

Q: Is data encrypted at rest? Yes, with AES-256 encryption. Q: Is data encrypted in transit? Yes. All traffic between customer environments, ResolveAI satellite, and ResolveAI cloud uses TLS 1.2+. Q: Does ResolveAI support SSO? Yes. ResolveAI supports SAML and OIDC-based SSO for customer users.

​
Customer Responsibilities

Q: What should customers do to ensure security?
  • Scope API keys to the minimum required permissions — read-only for investigation, and write permissions only for integrations where you have enabled Mitigation Actions or Git Code Remediation.
  • Configure redaction rules for PII/secrets.
  • Regularly audit and rotate credentials.
  • Set up SSO for user authentication.
  • Verify satellite environment configuration.
  • Review the Mitigation Activity dashboard to audit all write actions taken through Resolve.