03 · Service
Your premises, our operations.
The gateway runs on your infrastructure, with your data, under your keys. Masbando keeps it healthy, current and compliant from Zurich, through support sessions you approve, one at a time.
Designed for organisations that want the control of an on-premises installation without building a platform team for it.
Picture
What runs where.
The gateway, your data and your keys stay on your premises. The fleet service in Zurich receives health signals, delivers signed releases and model recommendations, and brokers the support sessions you approve one at a time.
Principles
Four rules that do not depend on good intentions.
Remote management by a vendor is a risk in itself. These four rules are built into the gateway, not written into a contract.
You stay in control
The remote agent is off by default and can be disabled at any time. Every remote action is visible to you in real time and in the audit log, whose authoritative copy is yours.
Outbound only
Your installation opens a mutually authenticated TLS connection to our fleet service. No inbound ports, no VPN, works behind proxies. Air-gapped sites get signed offline bundles.
Scoped, time-boxed, approved
Capabilities are explicit scopes: health, anonymised metrics, configuration, logs, upgrades. Anything beyond health needs your approval with a reason and a duration, four hours by default, a day at most.
Cryptographic, not cosmetic
Log tiers are encrypted for your roles. We hold no key unless you re-wrap a range for one session. Support traffic passes our relay as ciphertext; the relay sees bytes and timing, nothing else.
Included
What we take off your hands.
The operational work that an AI gateway needs every month, done by the people who wrote it.
Health and monitoring
Liveness, version, database connectivity, certificate expiry, anonymised metrics. Alerting on our side, so we call you before you notice.
Updates, signed
Releases are signed with an offline key, staged through the upgrade scope and verified by your installation against the key built into its binary. Restart only with your approval.
Model curation
The model landscape changes monthly. We evaluate new models against test suites per use case and publish signed recommendations; your aliases follow them within your constraints, or stay pinned.
Configuration as reviewed drafts
Changes to flows, policies and the catalogue arrive as drafts with a diff. You activate them, or grant activation for a session. Every change is audited and reversible.
Backups and restore drills
Encrypted, signed backups to your S3-compatible storage with offline recipient keys, object lock and automatic restore drills. A backup counts once it has been restored.
Compliance evidence
Evidence packs per profile and quarter: retention, residency, approvals, access. What your auditor asks for in March, prepared in January.
Session
Support without looking inside.
How a support session works, step by step. The same procedure applies to an emergency: a shorter approval path with pre-defined approvers and stronger notification, never a bypass of the approval record.
- 01
We ask
A Masbando operator requests scopes for your installation with a reason, a ticket and a duration. Operators sign in with MFA and receive short-lived certificates from our CA, which your installation pins.
- 02
You see exactly what would become visible
Your approvers are notified in the UI, by e-mail or webhook. They see the requested scopes, can narrow them, approve or deny. Nothing flows before the approval is recorded in your audit log.
- 03
The session runs through a blind relay
A second, mutually authenticated TLS session between the operator and your installation is tunnelled through our relay as opaque frames. Every method is checked against the granted scopes inside your installation; the relay is not trusted to enforce anything.
- 04
You watch, and can end it
Every action streams to your remote-session view and is logged on both sides. The session ends on expiry, on operator disconnect, or when you terminate it. The ephemeral key is destroyed.
- 05
Nothing leaves that you did not grant
Telemetry beyond health and anonymised metrics does not exist. Content tiers can only be read for a session you re-wrapped, and never without a recorded approval, with dual control for content.
Offline
Also for air-gapped sites.
Where no connection is allowed, the same service works with bundles instead of sessions.
Support bundles, redacted
Your installation produces a signed, compressed bundle: version, configuration with secrets redacted, operational logs, metrics. The redaction profile is a reviewable text file, and the UI shows what will be included before export.
Updates as signed bundles
Releases, model catalogue and recommendations arrive as signed bundles that the installation verifies against the key built into its binary. The behaviour is identical to the connected case.
Terms
Service levels.
Response times, standing grants and the scope of the service are agreed per contract.
- Response
- Response and resolution targets by severity, agreed per contract.
- Standing grants
- Typically health and the staging of upgrades; everything else per session.
- Pricing
- A monthly fee per installation, on request.
- Contracts
- Service description, data processing terms and an outsourcing register entry for regulated customers.
- Prerequisite
- An MMI Gateway installation, or a pilot that starts with one.
Contact
Let us run it.
Tell us where the gateway would run and who would approve sessions. We describe the setup and what a month of operation looks like.
- Phone
- +41 44 244 90 40
- info@masbando.com
- Office
- Masbando GmbH, Zurich