Every connection, one more source of truth in your diagnosis.
Code repositories and databases today; cloud and observability on the way. The principle does not change: the diagnosis declares what it does not see — and every new connection shrinks that list.
A PUBLIC REPOSITORY CONNECTS WITH NO CREDENTIAL AT ALL
The security model, side by side
ArchConnection replaces the long-lived token with an app installation and an ephemeral credential per execution. The migration is gradual — the traditional token remains available.
| Token (PAT) | ArchConnection | Public repo | |
|---|---|---|---|
| What is stored | long-lived token, encrypted | nothing permanent | nothing |
| Access duration | until manual revocation | minutes, single use per scan | — |
| Scope | broad — everything the user sees | only the repositories the admin chose | — |
| If it leaks | high blast radius | limited by the credential’s permissions and lifetime | none |
Bound to the organization, not to a person: whoever leaves the company does not take the access along — and uninstalling the app revokes everything at once.
Databases without production access
The database capabilities share one principle: inspect structure without reading row data.
Structural snapshot
The DBA exports the schema (no data) and uploads the file. No credential, works in a closed network — and a guard rejects any file containing real data. PostgreSQL and MySQL/MariaDB validated; others in validation.
Direct connection (read-only)
A read-only metadata account keeps the structural view current, so the assessment can work from up-to-date evidence.
Continuous telemetry
Usage statistics — indexes actually used, table growth — without ever reading row data. Risk goes from static to measured.
Declared roadmap
The roadmap identifies the evidence each planned connection would add. Availability is stated clearly, without a promised release date.
real response time per route, production errors crossed with the code's critical points, delivery indicators with real data.
cost per component crossed with the Executive Report's decision matrix; continuity actually configured, not just declared in code.
database audit goes from a dated snapshot to continuous tracking of the structure.
uploaded documents provide additional context and can strengthen confidence across the unit's assessments.
The mechanism already exists in the product: the assessment declares a confidence ceiling for what it can see — code, git history, and ready steps waiting for each new source. Connecting does not change the wording: it changes the number, auditably.
Connect a repository and see the difference.
In the demo, we connect one of your repositories (or a public one) and the first assessment shows what each source adds.