What can stay local
In agent mode, connector credentials are resolved on the agent host and are never sent to the control plane. Reach stays outbound-only.
Trust & architecture
Say where it runs.
Say what crosses the wire.
RapidValue runs its managed governance plane in the EU on European-owned cloud infrastructure. A lightweight agent can keep connector execution and credentials inside your environment, using outbound HTTPS only.
Tier-3 hybrid architecture
SaaS simplicity. Local reach and credential custody.
The control plane runs the identity model, governance, dashboards, decisions and evidence. A lightweight agent can reach private systems and resolve connector credentials inside your environment.
Belgian company · EU control planeOutbound HTTPS :443 onlyECDSA P-256 agent identityWalk-away clean
Connection boundaryOne governance plane. Your choice of execution.Choose managed or agent mode for each connector.
Inside your networkYour environment
Tier-3 agentRuns connector code and reaches private systems
Local or external vaultCredentials are resolved here—not in our SaaS
ADLDAPHRApps
Results + selected identity data →← Tasks + signed configurationOutbound HTTPS :443No inbound portsSecrets never cross
EU data region · managed cloudEU control plane
Identity modelIdentities · accounts · entitlements · grants
Governance and decisionsPolicies · reviews · risk · reconciliation
EvidenceDashboards · audit packs · immutable history
Internet-facing SaaS connectors can run in the control plane. Use agent mode when network reach or credential custody must remain inside your environment.
The exact boundary
Credential custody and identity data are two different questions.
What governance needs
The selected identity model—identities, accounts, entitlements and grants—reaches the EU control plane because reconciliation, risk, reviews and evidence operate there.
Bring your own vault
Use HashiCorp Vault, Azure Key Vault or AWS Secrets Manager. RapidValue stores the reference; your secret backend keeps the value.
Hosting & residency
One product. Four deployment models.
Start with RapidValue as a managed service on European-owned cloud infrastructure in an EU data region. When architecture or policy requires a different boundary, choose managed AWS, customer-managed cloud or on-premises.
European cloud. By default.
European-owned cloud · EU data regionRapidValue’s managed service runs on European-owned cloud infrastructure in the EU. European hosting is part of the standard service—not a premium tier or special configuration.
Built into RapidValue from day oneManaged AWS SaaS
AWS cloud · agreed regionChoose a managed AWS deployment when your cloud standards, procurement policy or regional requirements call for AWS.
For AWS-aligned architecture and regional requirementsCustomer-managed cloud
Your cloud account · designed togetherRun RapidValue inside your cloud boundary when your security architecture or procurement policy requires customer-controlled infrastructure.
For customer-controlled infrastructure and operationsOn-premises
Your datacenter · designed togetherDeploy RapidValue within your own datacenter for strict isolation, residency or infrastructure-control requirements.
For strict isolation and datacenter controlOperational assurance
Six controls that remain visible after deployment.
Architecture only earns trust when its boundaries continue into daily operation. These are the controls a security review can inspect in the running product.
Tenant isolation
Tenant context is enforced through the application and backed by database controls.
Data minimisation
Choose which objects and attributes enter the governance model.
Immutable evidence
Audit history is hash-chained and signed exports make tampering detectable.
Platform access
SSO, MFA, scoped API credentials and governed admin roles protect RapidValue itself.
Operational safety
Engine pause and safety limits stop unexpected automation with a reason attached.
Data-subject workflows
Export and erasure support Articles 20 and 17 with an explicit legal-retention boundary.
Bring your security review