Security your team can verify, not just trust
Fleet is a single Go binary with zero network exposure, zero telemetry, and zero cloud dependencies. Every claim on this page is verifiable with standard tools.
Security-first architecture
Fleet was designed from day one to have the smallest possible attack surface. No network listeners, no external dependencies, no data exfiltration paths.
Single Go binary
One statically compiled binary. No runtime dependencies, no interpreters, no JIT. Minimal attack surface by design.
No container runtime
No Node.js, no Docker daemon, no container orchestration. Nothing running that you didn't explicitly start.
SQLite embedded database
All state in a single local file (~/.fleet/fleet.db). No database server, no network-accessible data store, no connection strings.
Unix domain sockets only
All inter-process communication via Unix domain sockets. Zero TCP ports opened. No network listeners, no attack vector from the network layer.
Zero telemetry
No analytics, no usage tracking, no phone-home. Fleet never contacts any external server. Verify with a packet capture — the binary is silent.
No external API calls
Fleet makes zero outbound network requests. Your code, agent output, and operational data never leave the machine.
Your data never leaves your infrastructure
Fleet has no cloud component. There is no server to send data to, no API to call, no telemetry to disable. Data sovereignty is the default.
- All data stays on customer infrastructure — no cloud component whatsoever
- No external API calls from the Fleet binary at any point during operation
- Code and agent output never leave the machine they run on
- SQLite database stored at ~/.fleet/fleet.db (configurable via FLEET_DB_PATH)
- Unix domain sockets for IPC ensure data never traverses a network
- No credentials, tokens, or secrets are transmitted to any third party
Air-gapped deployment
Fleet runs fully offline after a one-time binary download. No internet connection is required at any point during operation.
Fully offline operation
After a one-time binary download, Fleet requires zero internet connectivity. No license servers, no activation, no update checks.
No package manager dependency
Single binary download. No npm, pip, apt, brew, or any package manager required for installation or operation.
No runtime downloads
Everything Fleet needs is compiled into the binary. No dynamic module loading, no remote resource fetching, no CDN dependencies.
Classified environment ready
Designed for disconnected, classified, and SCIF environments where outbound network access is physically impossible.
Enterprise governance built in
Every governance feature ships in the binary. No add-ons, no enterprise tier unlock, no separate modules to install.
Per-agent budget enforcement
Set cost limits per agent with cumulative tracking. Agents that exceed budget are automatically stopped.
Complete audit trail
Unified fleet log captures every decision, every agent action, every approval — chronologically and immutably.
Pipeline approval gates
Multi-stage pipelines with mandatory human approval. Rejected work routes back with context for remediation.
Agent quarantine
Instantly isolate misbehaving agents. Quarantined agents cannot execute, publish events, or interact with the fleet.
Org hierarchy with RBAC
Org-tier and repo-tier agents with role-based access control. CEO, CTO, department heads, and scoped developers.
6-dimension eval scoring
Every agent run is scored across task output, reliability, quality, efficiency, collaboration, and cost.
Logistic regression risk model
8-feature risk model predicts agent failures before they happen. Proactive risk assessment on every run.
Dry-run validation
Validate agent behavior in dry-run mode before production deployment. No side effects until you approve.
Verify it yourself
Every security claim Fleet makes is independently verifiable. No trust required.
No network listeners
$ lsof -i -P -n | grep fleet# (no output)No outbound connections
$ tcpdump -i any -c 100 'host not localhost' & fleet status# 0 packets capturedSingle binary, zero dependencies
$ file $(which fleet)fleet: Mach-O 64-bit executable arm64$ otool -L $(which fleet)# only system librariesLocal data only
$ ls -la ~/.fleet/fleet.db-rw-r--r-- 1 user staff 245760 fleet.db$ sqlite3 ~/.fleet/fleet.db ".tables"agents events fabric_events pipelines ...Reporting vulnerabilities
We take security reports seriously. If you discover a vulnerability, we want to hear about it.
Report security vulnerabilities to
security@fleetctl.aiInclude a description of the vulnerability, steps to reproduce, and any relevant proof-of-concept. We will acknowledge receipt within 24 hours and provide a detailed response within 72 hours.
Ready for a security architecture review?
Our team will walk your security engineers through Fleet's architecture, data handling, and governance model.