Most of this category is disqualified before the demo
When intelligence cannot transit a shared cloud, the vendor list collapses. Platforms that treat on-premise as a support exception rather than a supported topology either cannot deploy, or deploy in a configuration nobody will sign off. The constraint is not a preference to be negotiated; it is the first question.
Runs where the data has to stay
Cloud, hybrid and on-premise are distinct supported topologies, and the collection side can run separately from the platform it reports into. That is what allows a deployment inside an environment with no outbound path, rather than a cloud product with an on-premise asterisk.
Cloud, hybrid and on-premise as first‑class deployments
Collection deployable separately from the platform
Access model built on least privilege and enforced beneath the application
Auditable evidence and reasoning retained on every finding
Questions we get asked
- Can this be deployed with no outbound connectivity from our environment?
- The collection side can be deployed separately from the platform it reports into, which is the property that makes restricted deployments possible. The exact topology depends on your constraints and is worth walking through specifically rather than generically.
- Who can see our findings?
- Access is enforced beneath the application, on the data itself, rather than by the interface deciding what to show. Cross-boundary access is a small, identifiable set of paths rather than an emergent property of the codebase.
- Does KeyPriv hold a certification we can rely on?
- Ask us directly and we will tell you what exists and what does not, rather than showing you a badge. The platform includes tooling for tracking control frameworks, which is a different thing from holding an audit report, and the distinction matters in your procurement.
- How does this integrate with what we already run?
- A REST API covering the platform surface, and event streams that deliver findings as they are produced.