A lightweight Python agent runs inside your network. Connector credentials (AD passwords, API tokens, OAuth secrets) are encrypted at rest with a machine-bound key and never transmitted to our control plane. No inbound ports, no VPN tunnel, no firewall exceptions. One-line installer.
How it works
The control plane handles task scheduling, configuration, dashboards, and aggregated reporting. The agent handles connector execution, raw identity data, and local secret resolution. Connector credentials never leave your network — by architecture, not policy.
agent-vault.json — encrypted credentialsResult: you get the operational simplicity of SaaS with a sharp, enforceable data boundary. Auditors can verify that connector secrets never crossed it by reading 200 lines of agent source code.
Side-by-side security comparison
Classic IGA platforms (SailPoint, Saviynt, Omada) typically deploy a virtual appliance behind a customer-managed VPN to reach AD. The VPN gets you connectivity — but it also gets you a wide-open IP tunnel between the vendor's SaaS and your internal network. Here's how the tier-3 agent compares on every security dimension that comes up in customer reviews.
| Dimension | Classic SSL VPN deployment | RapidValue tier-3 agent |
|---|---|---|
| Where connector credentials live |
Vendor's SaaS Stored in the vendor's vault. Encrypted in transit + at rest on their side. Your customer security review must trust their key management, their backup process, and their breach response. |
Your machine Stored in agent-vault.json on the agent host.
Encrypted with a machine-bound master key (env var, local file,
or external secret store like Azure Key Vault / HashiCorp Vault).
Never transmitted to the control plane.
|
| Network ingress |
Inbound permitted SSL VPN tunnel terminates inside your network. By design, the vendor's appliance can initiate connections to anything reachable from that VPN endpoint — broad blast radius. |
No inbound Agent connects outbound on port 443 to *.rapidvalue.eu.
No listening ports on the agent host. Your firewall sees one
well-known TLS destination. Nothing else.
|
| Data classification reaching the SaaS |
Raw, unfiltered VPN sees AD bind events, raw user attributes, password operations. Vendor's SaaS holds full identity data including sensitive fields (employee numbers, badge IDs, sometimes salaries). |
Filtered + aggregated Agent reads raw data, applies the configured field mapping before upload. Sensitive fields can be hashed, dropped, or kept entirely on-side (read-only governance use case). |
| SSRF / arbitrary-target risk |
Open by default VPN tunnel doesn't limit what the SaaS-side can ask. A compromised control plane can reach any internal service from the VPN endpoint — DBs, secret stores, internal admin panels. |
URL allowlist Every tunnelled HTTP request from the control plane carries allowed_base_url = the configured connector base URL.
Agent refuses any URL that doesn't match. Closed by default,
not "lock down after the fact".
|
| Authentication of control plane → endpoint |
VPN-level Authentication happens once (VPN handshake). After that, the tunnel is fully trusted. No per-request signing or replay protection. |
Per-session signed Agent authenticates via ECDSA P-256 keypair + challenge-response. Short-lived 4-hour JWT access tokens. Nonces are one-time, verified against agent's registered public key. Optional mTLS layered on top. |
| Audit trail of vendor-side actions |
In the vendor's hands VPN connection logs are at the vendor; any unusual action takes a ticket + their breach-response process to surface. Often discovered months after the fact. |
Local + immutable Every connector call is logged on the agent host and reported back to the audit chain (HMAC-signed, PostgreSQL-trigger-immutable). Verify from your side at any time without vendor involvement. |
| Self-update integrity |
Vendor-managed Vendor pushes appliance updates over the tunnel. Verification depends on their build pipeline + your trust in their signing process. Limited rollback options. |
HMAC-verified + auto-rollback Each release is HMAC-SHA256 signed with a per-agent key. Agent verifies before swapping. Failed boot within 60s restores previous binary automatically. No emergency SSH required. |
| Blast-radius caps (write operations) |
None at network layer VPN doesn't know what's a "normal" provisioning rate. A misconfigured policy or compromised SaaS can mass-modify your AD before the standard IGA safety thresholds even check. |
Per-agent thresholds Provisioning thresholds (creates / updates / deletes) configured per agent boot. Once breached, the agent refuses that operation class until you investigate. Belt-and-suspenders alongside the control-plane safety guards. |
| Decommissioning |
Formal teardown VPN cert revocation, firewall rule cleanup, appliance VM decommissioning, vendor-side tenant deletion. Multi-week process for a 2-week POC that didn't convert. |
One commandsystemctl stop rv-agent (or kill the Docker container).
Agent stops accepting tasks; vault file can be deleted; firewall
rules and accounts go untouched. Walk-away clean.
|
Connector credentials handled by the tier-3 agent stay inside your network for the entire connector lifecycle. The control plane never receives them, never logs them, never backs them up. Our standard MSA encodes this as a binding architectural commitment, not a policy you have to trust. Read the agent source (≈ 1200 lines of Python) and verify yourself.
Why this matters in EU sales cycles
A security review for the tier-3 agent is bounded: read 1200 lines of agent source, verify the outbound-only TLS, confirm the credential-storage path. Same-afternoon sign-off is realistic. SSL VPN reviews routinely take 4-8 weeks because they involve network architects + vendor trust documentation.
For German Mittelstand, French ETI, Dutch publieke sector — "we don't send credentials to your cloud" is the kind of statement that closes deals. Tier-3 hybrid is the technical spec underneath that statement, and the agent source is the proof.
The control plane runs on EU-domiciled infrastructure (AWS eu-west-1 standard, OVH or Scaleway on request). Connector credentials never reach it. So even if a Cloud Act order targeted our SaaS, your AD passwords aren't there to hand over.
POC didn't convert? Kill the agent process. No formal decommissioning,
no certificate cleanup, no IAM role review. Everything that lived in
your network leaves with one systemctl stop.
Deployment
Our EU cloud (eu-west-1) + agent in your VPC
Operational simplicity of SaaS. Connector credentials inside your network. Standard configuration for 80%+ of customers.
~5 min install
OVH or Scaleway control plane
EU-domiciled infrastructure, no US Cloud Act exposure. Agent unchanged. Standard for public-sector + defence-adjacent verticals.
On request · same SLA
Control plane in your cloud account
Deployed via Terraform in your environment. Your IAM, your VPC, your backups. Agent is optional — you can run all in-cloud.
Helm + Terraform modules
Docker Compose or Kubernetes
Air-gapped supported. Update channels via your internal mirror. Standard for tier-0 critical infrastructure customers.
Annual support contract
One-line installer in your VPC. Standard outbound-only firewall rule. We'll show you the source, the vault, and the audit chain — same call.
Book a POC demo →