Documentation
Author changes in a version-controlled canvas, watch for drift, ship safely, and report on it — all in one governed pipeline.
Veltrix is a Security-as-Code change-control plane: it lets you manage the configuration of your security tools as code, with automated validation, drift detection, approval-gated deployments, and a full audit trail. Instead of clicking through a dozen tool consoles and hoping no one made an undocumented change, you author configuration in one place, review the exact diff, and promote it through a governed pipeline.
The platform runs two ways: as a fully managed hosted SaaS, and as a free, self-hostable open-source Community Edition (Apache-2.0). The same open-source apps and the same change pipeline run on either, so you can start hosted and self-host later — or the reverse — without changing how your team works.
Veltrix is also built for the AI era. Automation and AI agents can propose configuration changes through scoped API keys, but nothing reaches a production security tool until a named human reviewer approves the actual diff. AI drafts, humans decide, and the pipeline enforces.
Veltrix separates what gets configured from how it ships. Apps describe the configuration of a specific security tool, while the platform provides the change-control pipeline, connectivity, credential handling, and authoring surface that every app inherits. The result is one consistent, governed workflow across an otherwise fragmented security stack.
Each integration is an open-source app that packages a manifest contract, six pipeline handlers, and Configuration Canvas templates for one tool. Apps install from the published marketplace catalog and ship with their server-side handlers precompiled, so they run identically on hosted and self-hosted instances.
The engine that moves a configuration safely from draft to production — validate, approve, deploy (direct, canary, blue-green, or rolling), health-check, drift-detect, and rollback — with approval gates and per-environment auto-rollback thresholds.
A shared connectivity layer reaches self-managed components through providers such as Tailscale, SSH, WireGuard, and Cloudflare Tunnel. Apps never build their own SSH or VPN plumbing, and credentials stay encrypted at rest and are decrypted only at deploy time.
Tenant admins add and test a tool's credential once under Settings → Connections, or complete a one-click consent onboarding that stores no secret at all. Handlers resolve the decrypted credential server-side only — it never leaves the server or reaches the browser.
A visual, version-controlled model for authoring configuration — items, groups, and typed fields, including live pickers that source their options from the connected tool. Microsoft Entra ID, for example, resolves reference fields across all 42 of its configuration types to real groups, apps, users, roles, and service principals in your tenant — searchable dropdowns instead of pasted names or GUIDs. Every edit is captured in history, so you can see what changed, when, and by whom, and restore any prior version.
These building blocks compose into a single control plane: apps supply the tool-specific knowledge, while the pipeline, connectivity, and credential seam provide the safety and governance every change passes through.
Every configuration type moves through the same six-handler pipeline, so changes ship the same governed way regardless of tool.
Veltrix reconciles what is actually running against the approved desired state, on demand or on a schedule.
Tool integrations are open-source apps installed from a published catalog — 96 apps across nine categories.
Every app documents exactly what it manages as code, and what's intentionally excluded, in its own README Coverage section.
Connect a tool once and every app route and pipeline handler reaches it securely.
Build and iterate on apps against your own tenant with the Veltrix CLI, without touching production.
veltrix dev@veltrixsecops/app-sdkApps that provision their own hosted infrastructure get a Bring-Your-Own-License / Bring-Your-Own-Cloud console.
Governance is built in: fine-grained roles decide who can author, approve, and deploy.
Model your environments and govern how security configurations promote from one to the next.
Veltrix ships with 96 open-source apps spanning SIEM, EDR, SOAR, IAM, Network, Cloud Security, Compliance, Endpoint Management, and Threat Intelligence — including Splunk, Microsoft Sentinel, and Elastic Security; CrowdStrike Falcon, Microsoft Defender for Endpoint, and SentinelOne; Cortex XSOAR, Splunk SOAR, and Tines; Okta, Microsoft Entra ID, Ping Identity, and HashiCorp Vault; Cloudflare, Palo Alto Panorama, and Zscaler; Wiz and Aqua Security; and Tenable, Qualys, and Snyk. Each one plugs your tool into the same governed change pipeline: validation, human approval, safe deployment, drift detection, and rollback.
A recent config-as-code deepening pass added roughly 83 new configuration types across 26 previously shallow apps, each documenting exactly what it manages versus what's intentionally excluded — secrets, one-shot actions, read-only surfaces — in its own README Coverage section. Palo Alto Panorama, IBM QRadar, Splunk SOAR, HashiCorp Vault, Netskope, Cloudflare, Snyk, and Mimecast got the deepest coverage.
Don't see your tool? Every app is open source, so you can build one with the SDK and CLI, or request it in the issue tracker. See the full catalog on the Supported Vendors & Apps page.
Veltrix applies one governed workflow to the many ways security teams change their tools. Here are the most common:
Manage the configuration of your security tools as code — authored in a versioned canvas, validated automatically, approved on a visual diff, and deployed with a safe strategy and automatic rollback.
Key benefits: One consistent process across a fragmented stack, fewer risky manual console changes, and a reviewable history of every change.
Continuously compare what's actually running against the approved desired state. When something changes out of band, Veltrix flags the delta — with who-and-when attribution from the tool's own audit log — and raises an alert on critical drift.
Key benefits: Undocumented changes surface fast, alerts answer who and when rather than just what, and you can correct drift by re-deploying the approved state.
Let automation and AI agents propose configuration changes through scoped API keys, while a named human reviewer promotes anything that reaches production. Progressive deployment and drift detection contain the blast radius of a plausible-but-wrong change.
Key benefits: The speed of AI-authored changes with a human sign-off on every diff, and full provenance of who — or what — proposed each change.
Promote a configuration from development through staging to production, with credentials scoped per environment and approval gates at each stage — per-stage, single, or auto-promote.
Key benefits: Test changes before they reach production, keep environment credentials isolated, and see each configuration's stages and gates in one live pipeline view.
Because every proposal, approval, deployment, and rollback is recorded and attributable, your change history becomes audit evidence instead of something you reconstruct from screenshots and tickets.
Key benefits: Ready evidence for SOC 2, ISO 27001, and CIS Controls programs, reduced audit-preparation time, and a clear, attributable record of every change.
The Veltrix platform runs two ways — as a fully managed hosted SaaS, or as a free, self-hostable open-source Community Edition — so you can choose the operating model that fits your organization:
| Deployment Type | Best For | Key Considerations |
|---|---|---|
| Hosted SaaS | Teams that want a fully managed platform with no infrastructure to run | Quick setup, continuous updates, subscription-based pricing |
| Self-Hosted (Community Edition, open source / Apache-2.0) | Teams that need to run Veltrix in their own environment or keep everything in-house | Free and open source, self-managed upgrades, runs the same apps and pipeline as hosted |
Either way, apps that provision their own hosted infrastructure support Bring-Your-Own-License and Bring-Your-Own-Cloud (BYOL / BYOC), provisioning into your own cloud account so a tool's infrastructure is managed alongside its configuration.
For detailed deployment requirements and procedures, see the Installation Options documentation.
Now that you have an overview of the Veltrix Security-as-Code platform, here are some suggested next steps:
Get your first Veltrix platform instance up and running quickly.
Explore the different deployment models in detail.
Drive the pipeline programmatically from CI/CD or AI agents with scoped API keys.
See which tools are available today, what's on the roadmap, and how to build your own app.
Was this documentation helpful? Let us know how we can improve it.