The fail-closed defaults, the tamper-evident audit chain, the SAP authority parsing, and the OTel signals are not premium features. They're the product. What changes between tiers is volume, support, and dedicated infrastructure.
For your first design-partner deployment.
For production traffic from one business unit.
For multi-region, multi-BU deployments.
No "audit chain on enterprise tier only" nonsense. The whole point is that the gate works the same way regardless of how much you pay.
Postgres-backed HMAC chain, end-to-end re-walk, integrity probe.
Schema-driven masking with PII drift detection.
BAPI_USER_GET_DETAIL + SUSR_GET_PROFILE_AUTH_OBJECTS with field-value enforcement.
AWS, Azure, GCP — real SDK calls, fail-closed on connector error.
OTLP HTTP exporter for metrics and traces. Wire to whatever you already run.
Env, AWS Secrets Manager, Azure Key Vault, GCP Secret Manager, HashiCorp Vault.
Self-hosted today — Docker image and Helm chart ship with the product. We deploy alongside your existing data plane (it's data-adjacent, not data-replacing). A managed offering is on the roadmap once we have three reference customers.
Two to four hours of work for an experienced platform engineer if you already have an OAuth IdP and a Postgres instance available. The first integration with SAP typically adds another half-day to map customer-specific auth objects through the Z-RFC extension point.
No. AegisAI does not call any LLM. The only "AI" in the name refers to the AI copilots calling AegisAI from the other side. The product is deterministic Python.
Commercial. Pricing is per-tenant. Source is available to design partners on a separate agreement; the standard commercial deployment is binary + Helm chart.
Yes — that's the default. AegisAI runs as a container alongside your existing services. Helm chart ships with non-root, read-only-rootfs, and seccomp defaults.
Standard image pull and pod replace. Audit-chain integrity is verified on every boot. Schema migrations run via Alembic on container start; PRODUCTION refuses to serve traffic if migrations fail.
