Built for environments that can't afford to leak data
ContinueOps automates disaster-recovery testing inside regulated networks - financial services, insurance, healthcare and the public sector.
No credential storage on the agent
The agent is a single stripped Rust binary. It never persists cloud credentials. Its own mTLS client certificate is held in the OS keystore (libsecret on Linux, Keychain on macOS, Credential Manager on Windows) - never on disk in plaintext. Runbook bytes are decrypted into memory, zeroised with the Zeroize trait the moment the run ends, and never hit disk.
Secrets injected at runtime
Integrate with HashiCorp Vault, AWS Secrets Manager, Azure Key Vault, GCP Secret Manager or CyberArk. Secrets are fetched per-step, scoped to the runbook variable that needs them, and zeroised when the step completes. Nothing is written to disk, logs or telemetry.
Outbound-only mTLS, zero inbound exposure
The agent opens a single outbound mTLS connection to the ContinueOps control plane over TLS 1.3. The control-plane root CA is compiled into the binary with obfstr (obfuscated at rest, not reconstructable from strings(1)) and used as the only trust anchor - the agent will not fall back to the system root store. Built on rustls, no OpenSSL at runtime. No inbound ports, no public endpoints, no firewall holes. Works inside locked-down VPCs, on-prem segments and air-gapped Windows environments via a forward proxy.
Proprietary ContinueOps model - data never leaves your environment
The agent ships with the ContinueOps reasoning model, purpose-built for runbook execution and operational decision-making. It runs entirely on your hardware - no Ollama, no Llama, no third-party model provider, no API keys handed to the agent or the infrastructure it executes against. Every prompt, response and tool call stays inside your VPC and is auditable in the same tamper-evident chain as every other run event.
Signed, stripped, reproducible binary
The agent ships as a statically-linked musl binary with debug symbols stripped and GPG-signed release artifacts. The embedded root CA, control-plane hostname and license public key are all obfstr-protected. Each deployment is license-key-gated with an expiry and a signed phone-home; air-gapped sites get an offline signed license with a fixed validity window.
How the connection actually works
One outbound mTLS tunnel from your VPC to our control plane. Runbooks come down, telemetry and signed evidence go up. Credentials and customer data never cross the boundary.
Control plane - runbook editor, approvals, audit log, dashboards.
- Runbook registry
- Approvals (HOL)
- Evidence + reports
Signed binary. Pulls runbooks, executes locally, streams results.
IAM credentials never leave this boundary.
Exactly what crosses the boundary
Stays inside your environment
- Cloud and system credentials
- Runbook YAML and step commands (decrypted in memory, never cached to disk)
- Runbook step outputs (stdout / stderr)
- Captured variables and intermediate state
- LLM prompts and responses (when local LLM is selected)
- Customer data the runbook touches (databases, files, queues)
Sent to the ContinueOps control plane
- Run status (pending → running → success / failed)
- Step name, order and duration (no payloads)
- Tamper-evident, quantum-safe evidence record + trusted timestamp (no payloads)
- Approval-gate decisions (HOL workflow metadata)
- Anonymised execution metrics (step counts, durations, model used) - EULA telemetry clause
- Heartbeat, agent version and license fingerprint for fleet management
Three deployment models
Managed
Fastest time-to-value
Control plane in our hardened EU/UK region. Agent in your VPC.
Customer credentials stay local; control plane sees only run metadata.
Hybrid
SaaS UX, local execution
Same as Managed, plus the proprietary ContinueOps reasoning model running locally on your hardware.
Runbook reasoning never touches a third-party model provider.
Fully self-hosted
Appliance / on-prem
Control plane and agent both run on your infrastructure. Offline signed licenses with fixed expiry replace phone-home.
For classified environments and the most risk-averse regulated entities.
Tamper-evident, quantum-safe audit chain
Every recovery run produces independent proof that it happened exactly the way the record says - sealed with quantum-safe cryptography, signed off by multiple senior approvers, trusted-timestamped and kept in write-once storage you control. Your auditors can verify all of it themselves.
Quantum-safe by design
Every record is sealed with next-generation, quantum-safe cryptography - built to stay secure not only against today's computers but against the quantum machines on the horizon. Evidence you capture today is still trustworthy years from now.
Tamper-evident records
Each disaster-recovery run is sealed the moment it completes. Any later change - to a single field or the whole record - is immediately detectable, so an auditor can be certain nothing was altered after the fact.
Independently verifiable
Auditors, regulators and your own risk team can verify the evidence themselves - without taking our word for it. The proof stands entirely on its own.
Multi-party approval
High-impact actions require sign-off from several named senior approvers using their own secure devices, with no single person able to act alone. Each approval is bound to the exact action it authorised.
Multi-vector timestamp verification
Every record carries independent, trusted proof of exactly when it was created, cross-checked across multiple sources so there is never a single point of failure or any doubt about the timeline.
Write-once evidence you control
Evidence is stored in your own environment in a write-once form that cannot be edited or deleted - even by us - with every related action fully logged. You hold the definitive record.
Compliance posture (stated honestly)
We'd rather be transparent than oversell. Here is exactly where we stand.
- ISO 27001Aligned (controls in place, certification in progress)
- SOC 2 Type IIEvidence-mapped via the platform's own compliance module
- GDPR / UK DPA 2018Data minimisation, EU/UK hosting, DPA available on request
- NIS2Incident reporting + supply-chain controls supported
On ISO 27001: we operate to the ISO 27001 control set and can share our Statement of Applicability and control evidence on request. We are not currently certified - we'd rather tell you that up front than waste your procurement team's time. Certification is in progress.
Need a deeper architecture review?
We'll happily walk your CISO, security architect or supplier-onboarding team through the agent design, secret-handling code paths and our DPA in a single session.