Remediation authority
Choose what Deixic helps with and what you approve.
Choose the systems Deixic connects, the changes that run within your policy, and the named approver for each sensitive change. Every closed item keeps a receipt you can export.
Runs
Enable branch protection
Within the policy you grant
Waits
Remove production admin access
Security approves by name
Sent to you
Set an access revocation deadline
Your team decides
Kept for every closed item
- Policy check before each change
- Named approver for sensitive changes
- Read-back check after each change
- Receipt with who authorized each change
- Decision history
- Activity and spend by agent
Choose the systems, permitted changes, and approvers for each rollout.
Choose what Deixic helps with and what you approve.
Give Deixic permission to help with specific security fixes. Your team chooses the systems it can use and which changes need review.
- Systems
- Connect the systems in scope: for most companies Google Workspace or Microsoft 365, GitHub, AWS or GCP, and the HR system, plus any of hundreds more. Each change stays within the permissions granted at the provider.
- Change classes
- Low-risk changes run within your policy. Sensitive changes wait for a named approver. Actions outside your authority are denied or sent to you as a decision.
- Approvers
- Name who approves each sensitive class. Approvers decide in the app queue or in Slack.
- Receipts and export
- Each closed item has a receipt: the changes, who authorized each, and the read-back checks. Export selected activity, with retention set in the enterprise agreement.
- Identity and roles
- OIDC SSO, SCIM, and roles govern access to configured connections, skills, and models.
- Keys and credentials
- Bring your own model keys; scope connector profiles and tools, and rotate or revoke managed credentials.
Choose where the platform and work run.
Confirm identity, credentials, storage, and support with IT before connecting production systems.
- Available
Managed Deixic
Use the managed deployment for production work with your own model keys and configured connections.
Review hosting - Available
Customer-operated Kubernetes
Download the charts, then confirm image access, identity, encryption keys, storage, and support before installation.
Download deployment charts - Available
Private Runners
Run Dex’s long jobs, coding work, and browser sessions on your Macs, Linux machines, containers, or Kubernetes clusters.
See Private Runners
Start with one task in one system.
Choose a task, set its permissions and approver, and review the result together. Expand when your team is ready.
- Your first task
- Connect a system and name the approver. Customers on a compliance platform connect it; Deixic reads its failing tests, fixes the underlying settings, and re-runs the tests there.
- Reusable company work
- Keep reviewed procedures and tests in Deixic; record each team's decisions and results separately.
- Deployment review
- Review architecture, retention, DPA, subprocessors, support and commercial terms. Deixic's SOC 2 Type II audit is underway.
Before you connect production work
Which changes run without approval?
The low-risk changes your policy grants. Sensitive changes wait for a named approver. Actions outside your authority are denied or sent to you as a decision.
Review action authorityCan we start with one system?
Yes. Choose one task in a system such as GitHub, AWS, Google Workspace, or your HR system. Set the permissions and approval owner for that task. Add more when your team is ready.
See the compliance runWhere does Deixic run?
Managed deployment and customer-operated Kubernetes are available for production. Private Runners run Dex's long jobs, coding work, and browser sessions on machines you control.
Review hosting and executionWhat is covered in procurement?
Review architecture, identity, credentials, data handling, retention, support, and commercial terms with Deixic. The procurement page links the DPA, subprocessors, and security material.
Open the procurement path