Security
Security and Deployment
Thaumaton is designed around clear boundaries: customer repositories stay separate, credentials stay in the customer environment, and review controls remain explicit.
Hosted deployment
In a hosted setup, Thaumaton coordinates work against customer-owned repositories and execution providers without turning the platform into a shared admin surface. Repositories, permissions, and review workflows stay distinct per customer environment.
- Credentials and access decisions remain under the customer’s control, not embedded in the public site.
- API and management surfaces stay authenticated and scoped to the configured runtime.
- Human approvals remain visible in the workflow before changes are merged or deployed.
Self-hosted deployment
Self-hosted deployment is possible only when the team has a provisioned environment and the repo access is already authorized by the organization. We do not publish private source repositories or a public Git clone path for the core product.
- Managed onboarding is the supported path for first-time setup.
- Self-hosted setup requires access provisioned by the team that owns the repo and deployment environment.
- Customer-specific credentials, secrets, and review policies are not included in the public site.
Planned integrations
ServiceNow (Planned), Zendesk (Planned), Claude Code (Planned), and similar integrations are planned, not available in the current release. We do not claim they are installed or supported in production.
Can I use ServiceNow (Planned), Zendesk (Planned), or Claude Code (Planned)? These integrations are planned, not available in the current release. Contact us with your workflow so we can discuss the integration requirements for a tailored demo.
Where you come in
Security is shared. These responsibilities stay with the customer or deployment owner.
- Provide the repo access and permission boundaries.
- Review the AI execution policy and approve the operational controls.
- Keep customer secrets, environment credentials, and deployment approvals outside the public marketing site.