Trust
Segmenta is only useful if you trust it inside your fleet, on the hosts that matter most. That trust should come from the design, not from a paragraph asking for it.
Identity & transport
Two listeners — one for humans, one for machines — so an agent certificate can never impersonate an operator, and an operator session can never act as an agent.
The agent gateway requires a valid client certificate. A validation failure closes the connection before the API sees the request. TLS 1.2 and 1.3 only.
No shared credential. Each agent carries its own certificate issued by the Segmenta CA, with a subject that binds it to both the agent and its tenant. Certificates last 90 days and renew over the agent's live session, so nobody re-enrols a host.
Enrolment tokens are stored hashed. A single-use token can't enrol a second host, and a multi-use token enrols nobody until you approve each host's code in the console.
Agent updates run from signed packages with their integrity checked before anything is installed.
Separation
Tenant data lives in separate schemas rather than being filtered in application code. A query that forgets its tenant filter returns nothing, instead of returning someone else's fleet.
Each tenant's flows, hosts and policy live in their own schema. The isolation is structural, not conventional.
An agent's certificate encodes its tenant. It cannot report into, or receive policy from, any other.
What we collect
Segmenta needs to know what talks to what. It does not need to know what they said, and it does not look.
What the agent sends
What it does not
Hosting & recovery
Your hosts don't need us to stay protected: they keep enforcing their last policy whatever happens here. Your console and your history do need us, so this is how they are kept.
Google Cloud, in Sydney (australia-southeast1). Cloudflare serves the console; agents connect straight to our agent listener. Ask us about another region or an isolated deployment.
A snapshot of the server's disk every day, kept 14 days, and a copy of the database every night in separate storage, kept 30 days. The account that writes the copies can add them but can't read or delete them.
We rebuild it from the latest copy, so you could lose up to a day of changes and history. We haven't yet timed a full rebuild end to end, and we'll publish that figure when we have it.
Connection records 30 days, observed denials 7 days, and the audit log until you set a limit. You can change each one in Settings, and a data processing agreement is available on request.
Reporting a problem
We would rather hear about a weakness from you than from an incident. Send it to us and you will get a human, not a ticket robot — and we will tell you what we did about it.
Questions
The ones that come up in every review.
Hosts keep enforcing the policy they already have. The control plane is how policy is authored and distributed, not how it is enforced, so losing it does not open your firewalls.
The agent receives policy and a fixed set of tasks, never arbitrary commands. It applies firewall rules and reports what it applied, and updates come only from signed packages whose integrity is checked first.
Tenant data is separated at the database schema level rather than filtered in application code, and each agent's certificate binds it to exactly one tenant.
Not yet, and we are not going to imply otherwise. What we can give you today is the design above, straight answers to a security questionnaire, and no NDA required to ask.
In Google Cloud's Sydney region, with nightly database copies in separate storage there too. Hosting and recovery has the detail. Ask us about another region or an isolated deployment and you will get a direct answer rather than a sales process.
Google Cloud hosts the service and its backups, Cloudflare serves the console, and an email delivery service sends sign-in codes and alerts. Nobody else. A data processing agreement listing them is available on request.
No NDA, no discovery call required. If the answer is “not yet”, that is what you will get.