Burnless is designed with a minimal data footprint:
| Data type | What it is | Where it lives |
|---|---|---|
sre.yaml |
Your SLO rules and thresholds | Your Git repo |
| Metrics | Uptime numbers like 99.85% |
Your Prometheus |
| Event logs | What Burnless did and when | Local file or your DB |
Key point: Burnless never touches your business data. No customer records, no payments, no PII — only metric numbers.
- Your service emits metrics (uptime, error rate, latency)
- Prometheus scrapes and stores those metrics
- Burnless agent reads your
sre.yamland queries Prometheus every 60 seconds - If burn rate is too high → runs runbook automatically
- Sends notification to Slack or PagerDuty
- Logs what it did
Each company gets their own isolated database. Company A can never see Company B's data. Ever.
- At rest — AES-256 encryption on all stored data
- In transit — TLS 1.3 on all connections (same as HTTPS banking)
- SAML/SSO — login with your company Google or Okta account
- Role based access — Admin, Editor, Viewer
- API tokens with scoped permissions
- Session timeout and MFA support
Every action is permanently recorded:
- Who changed which SLO
- When a runbook was triggered
- Who acknowledged an alert
- Non-deletable. Exportable for compliance.
| Option | Description | Best for |
|---|---|---|
| ☁️ Kairos Cloud (SaaS) | We host it, you log in | Most companies |
| 🏢 Your VPC | Runs inside your own AWS/GCP | Data-sensitive orgs |
| 🖥️ On-premise | Fully air-gapped, no internet | Government, finance |
| Certification | Status |
|---|---|
| SOC 2 Type II | Planned Q4 2026 |
| ISO 27001 | Planned Q1 2027 |
| GDPR | Compliant by design |
| HIPAA | Available on request |
Found a security issue? Please report it privately: See SECURITY.md for responsible disclosure instructions.
Do NOT open a public GitHub issue for security vulnerabilities.