Security event monitoring · on-premises first
See every signal. Prove every decision.
Pharelis collects events from your sources, detects threats with rules your team reviews, and turns findings into cases with evidence that stays verifiable — running entirely inside your own environment.
- external services required at runtime
- 0
- approval for detection rules and evidence disposition
- 2-person
- bilingual console
- EN · FR
Everything a security operations team needs, in one place
From raw telemetry to a closed case, every step is recorded and reviewable.
Reliable intake
Authenticated collectors and pull connectors deliver batches; a retried batch is recognized and never stored twice. Every record is parsed, de-duplicated or quarantined with a reason — nothing is silently dropped.
Reviewed detection
Threshold and sequence rules with a two-person review, shadow mode for safe tuning and historical evaluation before a rule goes live.
Findings to cases
Group findings into cases, assign owners, follow response plans and export investigation packages with the evidence they cite.
Fast investigation
Exact substring search across actors, hosts, addresses and actions, with time and source filters, scoped to your application.
Tamper-evident evidence
Original batches are stored encrypted, verified by digest and covered by integrity audits. Stored events cannot be altered — not even by the database owner.
Operations you can see
Product metrics, alert rules, worker diagnostics, delivery tracking and reconciliation reports show the health of the whole pipeline.
How it works
Four stages, each one auditable.
Collect
Sources push authenticated batches or connectors pull them on a schedule. Checkpoints make outages and replays safe.
Normalize
Records are validated against a canonical event model. Bad records are quarantined individually, never the whole batch.
Detect
Rules evaluate time windows per group. Findings keep a bounded, exact evidence sample and a version history.
Respond
Analysts triage findings into cases, apply legal holds and deliver signed notifications to your other systems.
Runs where your data lives
Built for on-premises Kubernetes and PostgreSQL, with nothing calling home.
On-premises first
Separate API and worker deployments with rolling updates, disruption budgets and default-deny network policies. A minimal, signed runtime image with no shell.
Your PostgreSQL
Ordinary versioned migrations run by a scoped migrator role. The runtime role has least privilege — no superuser, no extensions to install.
Private or public cloud
The same images and manifests run on any conformant Kubernetes. Configuration is per environment; secrets come from your secret store.
Proven rollouts
Rolling updates and rollbacks are rehearsed under live traffic, and every release passes an automated pipeline of build, test, scan and smoke stages.
Security and compliance by design
Controls are enforced by the platform, not left to policy documents.
Designed for Protected B
Designed around Government of Canada Protected B practices: least privilege, encryption, separation of duties and complete audit trails.
Encrypted evidence
Evidence is encrypted with AES-256-GCM, and file names and journals are keyed so backups do not reveal content. Connections to the database and identity provider use TLS.
Isolation enforced in the database
Forced row-level security keeps every application’s data separate, even if application code makes a mistake.
Legal holds and disposition
Retention policies, legal holds and two-person approved disposition, with completion records that are re-applied and verified after a restore.
Strict browser security
Strict Content Security Policy, Trusted Types, no third-party scripts and no tracking — in the console and on this site.
Complete audit
Every change by people and by the system is recorded in an append-only audit log with the reason and the actor.
Protected B describes how the product is designed. Accreditation for a specific deployment is granted by your organization.
Fits your identity and tooling
Use the directory you already have and connect the systems you already run.
Microsoft Entra ID
Single-tenant sign-in, server-owned entitlements per application, and support for Conditional Access claims challenges.
Active Directory and Keycloak
Federate on-premises Active Directory through Keycloak or another OpenID Connect provider, with groups mapped to roles.
Any OpenID Connect provider
Authorization code with PKCE, an approved-client list and per-application grants. No passwords are ever stored.
Signed webhooks
Findings and case events are delivered at least once, with stable identifiers and timestamped signatures that receivers can verify.
Frequently asked questions
Does Pharelis need internet access?
No. It runs entirely inside your network. It only connects to the sources, identity provider and webhook receivers you configure.
Which identity providers are supported?
Microsoft Entra ID directly, on-premises Active Directory through Keycloak federation, and any standards-based OpenID Connect provider.
What does it need to run?
A Kubernetes cluster, a PostgreSQL 17 database, shared storage for encrypted evidence and an identity provider. No database superuser is needed.
How is evidence protected from tampering?
Evidence is stored encrypted and verified by digest, stored events cannot be updated or deleted outside the governed expiry function, and every action is audited.
Is the console available in French?
Yes. The console and this site are fully bilingual in English and French.
Can detection rules be tested safely?
Yes. New rules run in shadow mode and can be evaluated against historical data before a second person approves them for production.
Ready to see it with your own data?
Sign in with your organization account, or contact us to plan an on-premises deployment.