Built on boundaries you can trust
Tickets, endpoint telemetry, documentation, and privileged credentials are different kinds of data, so they sit behind different boundaries, described here plainly.
- AES-256PER-CLIENT KEYS
- SEPARATEVAULT PERMISSION
- AUDITEDCREDENTIAL REVEALS
Documentation and credentials are not the same thing
Credentials sit in a vault with their own permission and encryption, not in ordinary document fields inside a knowledge base.
Operational documentation
Runbooks, environment notes, and procedures that technicians read while working a ticket.
- Operational runbooks and procedures
- Environment and configuration notes
- Version history with restore
- Role-based access within each client
Privileged credential vault
Computer and administrative credentials, held in a dedicated vault with its own permission.
- Dedicated vault, separate from documentation
- A separate permission to reveal passwords
- Encrypted with a separate key for each client
- Every reveal audited with who and which client
- Clipboard clears after 30 seconds
- Biometric check before reveal in the mobile app
- No offline caching in the web app or browser extension
Different data, different rules
Credentials
Administrative and computer credentials, kept in a vault rather than in documents.
- Separate permission from documentation
- Encrypted with a separate key per client
- Every reveal audited with who and which client
- Clipboard clears after 30 seconds
- Biometric check before reveal in the mobile app
- No offline caching in the web app or browser extension
- 09:41ACCESSVault permission checked · tech.d.reyes
- 09:41REVEALLocal admin password revealed · SRV-DC01
- 09:42CLIPBOARDClipboard cleared after 30s
- 09:58TOTPOne-time code viewed · tech.d.reyes
- 10:02DENYOut-of-scope request blocked: client mismatch
Every reveal is recorded with who did it and for which client.
Documentation
Runbooks, environment notes, and procedures used during service delivery.
- Scoped to each client
- Role-based read and edit
- Version history with restore
- 08:12READRunbook: Northwind VPN failover
- 08:30EDITEnvironment note updated · v14
- 09:05RESTORERunbook restored to v13
- 09:44READOnboarding procedure: workstation build
- 10:11DENYCross-tenant read blocked
Document access is scoped to the client it belongs to.
Endpoint data
Monitoring, health, patch state, and remote-operations activity from managed devices.
- Client and device-group scoping
- Remote actions tied to a named operator
- Policy-driven thresholds and response
- Script runs logged with who ran them and where
- 09:38ALERTFailed logon spike · DESKTOP-7F
- 09:40SESSIONRemote control started · tech.d.reyes
- 09:47SCRIPTDisk cleanup automation executed
- 09:52PATCH3 updates approved and deployed
- 09:55ISOLATEIsolation confirmed by typing the hostname
Remote sessions and script runs are attributable to a named operator.
Cloud signals
Microsoft cloud alerts and detections, expanding as additional signals are implemented.
- Per-client Microsoft connection
- Detection packs scoped per client
- Alert-to-incident behavior set per client
- Minimum severity per rule
- Only implemented signal sources are claimed
- 09:29DETECTImpossible-travel sign-in · user j.harris
- 09:29RULEM365 identity pack · severity High
- 09:30INCIDENTService Desk incident #4821 created
- 09:31NOTIFYOn-call security operator paged
- 10:04CLOSESignal correlated to ticket resolution
Incidents created from alerts record the rule that fired.
How Command AI handles customer data today
Bring your own AI, off by default
You connect your own AI provider and key (stored encrypted). AI stays off for each client until an administrator switches it on and records consent.
Evidence kept separate
Deep investigation keeps the evidence, the AI’s assessment, and its suggestions in separate sections.
Coverage and gaps shown
Investigate shows how much of the evidence it covered and what was missing.
Untrusted input handled as untrusted
In triage and investigation, ticket and alert text is wrapped as untrusted input before the model sees it.
No privileged action by AI
No AI path takes a privileged action. A technician runs each one and types the target device or account name to confirm; the highest-risk endpoint actions also need a press and hold.
Holds instead of guessing
Investigation stands down on stale incidents and puts an unclear answer on hold instead of acting on it.
Endpoint and network protection
Sentry EDR and Web Protection (DNS filtering) run inside Aegis, on the same policy engine and client scoping as the rest of Command. Detections land in Response Ops, so protection, triage, and response all stay in one place.
Review our controls with your team
We'll walk your security lead through the authorization model, audit trail, and credential boundary, and tell you plainly what isn't built yet.