Trust, by healthcare and community banking. Not by a generic SaaS checklist.
Per-tenant data residency. Encryption in transit and at rest. Role-based access with admin and user roles surfaced from the better-auth admin plugin. And a human-escalation path so a person is in the loop the moment an agent crosses its threshold. The four answers mid-market IT and security reviewers ask for, written straight.
Your tenancy, your data, your region.
Nightglass runs as a single-tenant deployment — never co-mingled with another customer. Telemetry is processed in-region and visible only to your tenant, and the agents themselves run in your environment — cloud, hybrid, or on-prem.
Single-tenant isolation
Your tenancy, your data — never co-mingled with another customer. Tenants cannot reach across the boundary, so a compromise on one does not bleed into yours.
Cloud, hybrid, or on-prem
Agents run in your environment — cloud, hybrid, or on-prem — not in a shared multi-tenant plane. The control plane stays inside your perimeter when the regulator requires it.
In-region processing
Telemetry is processed in-region and visible only to your tenant. Nothing leaves the region you sign for, and nothing is used to train shared or third-party models.
Encrypted in transit, encrypted at rest, isolated per tenant.
TLS on every transport path. At-rest encryption on the telemetry store and on the tamper-evident incident ledger. Per-tenant key isolation, so a single key cannot read two tenants. The substance a SOC 2 or HIPAA reviewer is asking about, written as copy rather than a cert list.
TLS in transit
Every transport path is reached over TLS — browser to app, agents to telemetry ingest, app to incident ledger. Plaintext transport is not a fallback path.
At-rest encryption on the data plane
Telemetry stores and the tamper-evident incident ledger are encrypted at rest with per-tenant key isolation, so a stolen-volume read does not return usable incident timelines.
Tamper-evident by construction
The incident ledger is built so the auditor-friendly read and the reality read cannot diverge. Reviewers see the same record the on-call saw at the time of the incident.
Two roles, scoped to your tenant, gated where it matters.
The better-auth admin plugin ships two role fields out of the box — `user` (the default for every new account) and `admin` (an explicit promotion). Admin-only routes stay gated by `requireAdmin()`. Custom role schemes are not invented here: the RBAC surface stays small enough to audit end to end.
Two roles out of the box
The better-auth admin plugin ships two role fields — `user` (the default for every new account) and `admin` (gated). No custom RBAC scheme to audit; the matrix is small and documented.
Admin actions stay within the tenant
Admins run only inside their own tenant. Cross-tenant reach is structurally impossible — a member of tenant A cannot act on tenant B, even with the `admin` role.
In-product surfaces for admins
Admins manage their team from /app/settings (member and role administration) and /app/whitelabel (per-tenant branding). Both are gated server-side by `requireAdmin()` — non-admins cannot reach them.
A person catches the handoff. In minutes, not hours.
The moment an agent crosses its escalation threshold — a novel failure surface, a confidence drop, a regulatory line — a named human on-call catches the page-out. The handoff ships with the same diagnostic packet the FAQ anchors to: root-cause hypothesis, correlated signals, blast radius, and a recommended next step in plain English.
A named human on call
When an agent crosses its escalation threshold — a novel failure surface, a confidence drop, a regulatory line — a named human on-call catches the handoff. The page-out is a person, not a queue.
A diagnostic packet, not a stack trace
Every escalation ships with a full diagnostic packet — root-cause hypothesis, correlated signals, blast radius, and a recommended next step in plain English. The on-call reads an incident, not a log line.
Response in minutes, not hours
The handoff path is measured in minutes from the page-out to the human reading the diagnostic packet. The escalation window is short on purpose: the goal is to compress time to human judgement, not to delay it.
Walk through security review with our team.
The architecture maps cleanly to a SOC 2, HIPAA, or vendor-risk questionnaire. Write to the address below with the line “Security review” and one of our engineers will reach out within one business day with the artifacts.