Private by invitation
Workspaces are provisioned for your organisation and people join only by invitation from your administrators. There is no open sign-up.
Security and tenancy
Built the way it asks your agents to be built.
Built by security people for security teams: sealed tenants, strong identity, hardened delivery and continuous review, so the tool that judges your agents holds itself to the same bar.
Strong sign-in
Two-factor authentication with recovery codes, and single sign-on with Microsoft Entra ID, Google Workspace, Okta or any OpenID Connect provider, with domain verification and optional enforcement.
Sealed tenants
Each customer's agents, reviews and credentials live in their own tenant. Isolation is enforced at more than one layer, so no customer can ever see another's data.
Encrypted end to end
Encrypted in transit and at rest. The credentials you lend to connectors are stored encrypted, used only for the sync you configured, and never displayed again.
Least privilege
Owners, admins, reviewers and submitters; separation of duties between the people who review and the people who bless; API keys scoped to what each pipeline needs.
Hardened delivery
Strict browser protections and security headers that earn top public grades, outbound connections limited to your platforms, and containers run with the minimum they need.
Audited end to end
Every submission, checklist step, decision, sync, membership change and sign-in is recorded per tenant and exportable. Any support activity by Vettly staff is visible in your own log.
Independently reviewed
Adversarial security reviews with every finding tracked to resolution, dependency and image scanning on every release, and a published way to report issues.
Built for the whole organisation
Business users submit. Security reviews. Leaders see the posture.
A plain-language intake asks what the agent does, what it can see and what it can do, with no security background required. Reviewers get a queue, a checklist and the evidence trail. Owners get notified at every step. Everyone signs in with the identity provider you already run.
Agent owners and business users
Describe what the agent does, sees and can do in plain language. Get notified at every step. Resolve conditions. Keep ownership current.
Builders and platform engineers
Submit precise specifications, gate deployments in CI, push live snapshots for drift, use scoped API keys per pipeline.
Security reviewers
Work a queue, verify the checklist against the real platform, request changes, recommend. Everything they touched is in the record.
Approvers and risk leaders
Bless with conditions, revoke, retire. Read loss exposure against appetite across the portfolio. Export the evidence.
Multi-business-unit by default. Owners, admins, reviewers and submitters per tenant; agents carry business unit and criticality; the dashboard rolls exposure up against the appetite you set; the registry export is the inventory your auditors ask for.
Built the way it asks your agents to be built.
Tell us about your organisation and the platforms your agents run on. We provision your workspace and you are reviewing your first agent the same day.
Request access