Seylo documentation

Start here

Understand the model

Seylo holds no cloud credentials for your clusters and opens no inbound connection to them. Knowing why changes how you evaluate everything else.

What Seylo is

Create your organisation

Sign up, verify your domain, and understand the four roles before you invite anyone.

Create your organisation

Connect your identity provider

Entra ID, Google Workspace, Okta, Auth0, Keycloak, or SAML. Map your existing groups to Seylo roles.

Set up single sign-on

Connect a cluster

One Helm command, run by you, inside your cluster. It dials out; nothing dials in.

Install the agent

The three things worth knowing before you evaluate

We never hold your cluster credentialsThe agent authenticates to Kubernetes with its own ServiceAccount, inside your cluster. There is no AKS, EKS, GKE or OKE credential on our side to leak.

Secret values are write-only, everywhereNo page, endpoint, log, audit row, error message or export ever returns a Secret value. Not to an operator, not to an administrator, not to us.

You can verify what you installThe agent image and Helm chart are signed with cosign keyless and recorded in the public Rekor transparency log. Check provenance before you install, in one command.