SECURITY · ALPHA DISCLOSUREAPRIL MMXXVI
Honest about alpha.
Salvo is a portfolio pilot. The posture below is what we actually have today. Regulated teams should wait for v2.
Access to your systems.
- — Read-only connection to your alerting platform.
- — No write permissions to your infra. The agent cannot run commands.
- — No SSH key handling. No kubeconfig ingestion.
- — All mitigation snippets are presented to a human for execution.
Alert data.
- — Alert metadata is retained for the duration of the incident plus 90 days.
- — Your alerts are never used to train a shared model.
- — No cross-tenant correlation; each team's graph is isolated.
What we don't have.
- — SOC 2 attestation.
- — Regional data-residency options.
- — Air-gapped / VPC deployment.
Human-in-the-loop.
- — Every runbook step shows a confidence score.
- — Auto-resolve is disabled. Closing an incident is a human action.
- — Every salvo timeline event is labeled SALVO vs HUMAN.
SECURITY CONTACT · security@salvo.alphalast updated · 2026-04-21