How CloudPeek fits your environment.

CloudPeek connects to your existing security, cloud, identity and ticketing tools. It gathers context from them, investigates what happened and prepares the next step. Your tools remain in place, and approved actions go back through those same connections.

Run CloudPeek in the cloud, on your own infrastructure, or in a disconnected environment. Choose local, open-weight or sovereign models to suit your workload and policy. A frontier model is also an option where you permit external connectivity.

No external model connection is required. With a local or air-gapped deployment, the models and case record stay inside your boundary. A disconnected deployment has no phone-home telemetry or online licence check. Any permitted external connection follows the policy your team sets.

Your team defines the tools and actions each workflow may use. Start read-only, then enable response steps that CloudPeek prepares for operator approval. Read and write permissions are separate, and each workflow has limits on its scope, duration and number of steps.

If a workflow reaches its limits, encounters an unexpected state or cannot support its reasoning with evidence, it stops and escalates to your team. The investigation record is preserved so an analyst can review what happened and decide the next step.

Your authorised operators set the guardrails, approval requirements and escalation paths. Your team holds the kill switch and can stop a workflow. CloudPeek works within the authority you give it.

In the managed service, records are scoped to their customer’s tenant. The database applies that boundary to each transaction, keeping customer access separate even when infrastructure is shared.

Retention and disposal follow your organisation’s policy. The case record keeps findings, approvals and actions available for review and audit. New entries add to the history rather than rewriting earlier steps.