A technical explanation, not an absolute privacy slogan.
SSO, audit logs and “your cloud” are table stakes in this category. The buying question is the boundary: what remains inside the customer environment, what may leave through configured services, and who is responsible for recovery.
Use this pack in procurement. Then verify on your stack.
This page describes the product as designed. It is not a penetration-test report, a SOC attestation, or legal advice.
Boundaries
The control plane (portal, pipelines, identity adapter) and the workloads (your apps, agents, databases) run in the Kubernetes environment where Low-Ops is installed. They do not run in a multi-tenant public Low-Ops SaaS by default.
What stays inside that environment
Platform configuration, app images you deploy, database contents, secrets stored for those apps, and operational logs retained in the cluster or the sinks you attach.
What may leave
Anything an application is coded or configured to call: an external LLM, a SaaS API, a partner integration, or image pulls from a public registry. Self-hosting does not intercept those calls unless you add network policy.
Secrets
Application secrets are injected as configuration by the platform. You remain responsible for rotation policy and for secrets the apps themselves obtain at runtime.
Operator access
On self-hosted: your administrators. On managed service: named Low-Ops operators, under the tenancy model in the order. We do not require standing production access to your business applications.
Telemetry
Prometheus, Grafana and centralised logs are on by default inside your environment. We do not claim that no metric ever leaves — only that product telemetry is yours to route.
Identity
Keycloak adapts your identity provider. Teams and roles from that directory are enforced on the portal and on deployed apps. Supported IdP details are in the documentation; we do not list every connector as unique to Low-Ops.
Audit coverage
Create, build, deploy, start and stop actions by humans and agents are written to the audit log. Application-level events inside your code are your responsibility.
Patching
We keep platform components patched on the Professional/Enterprise path. You (or the managed-service contract) apply those upgrades. Community operators patch themselves.
Backup and recovery
Databases are backed up automatically. Restore, download and upload are portal actions. A tested restore is a customer (or managed-service) responsibility before production acceptance. Retention is configured per environment.
Managed-service tenancy
Two compatible models: (1) we operate Low-Ops in a cloud account or subscription in your name; (2) we operate it in a private cloud we run on your behalf. “Our secure, private cloud” in pricing refers to model 2. FAQ language about infrastructure under your name refers to model 1. The order states which applies.
Compliance language
Controls can support GDPR, the EU AI Act, NIS2, DORA, ISO 27001 and SOx evidence. Low-Ops is not a certificate, an audit, or a guarantee that a deployment is compliant or free of vendor concentration risk.