It works from pasted snippets
Someone copies a log into a chat window, strips the hostnames, and gets a confident answer about a system the model never saw.
Zero-trust AI operations
The AI gets the reach. Your operators keep the keys.
Bring your own LLM and let it work on production without handing it the keys. GAEZLA connects it to your systems through each vendor's own API. It helps you with a problem, answers a question, and drafts the change when one is needed. The AI never sees a credential. It reaches your systems only through GAEZLA, and nothing changes until a human operator approves it.
Thirty minutes to see how it works, or start a trial and connect your own systems.
Some of the systems GAEZLA connects your AI to.
VMware vSphereMicrosoft Hyper-VNetScalerCloudflareMicrosoft Graph / Entra IDMicrosoft AzureScalewayKubernetesArgo CDArgo WorkflowsGitHubCheckMKDatadogWazuhVelociraptorNetApp StorageGRID
See every integrationZerocredentials handed to the AI
Truststays with the operator: nothing changes until one approves
AIyours, through the vendor's whole API, not a short tool list
Operationsevery change recorded: who approved it, what ran, what came back
Everyone wants AI in production. Nobody trusts it.
In most shops the answer from above is a policy: the AI stays out of production. It would break something or leak something. Fair enough, as long as the AI has to hold the keys to be useful.
The vendor's MCP server wants a standing token
Each one ships with its own short tool list and an API key in a config file on someone's laptop, carrying the full rights of whoever created it.
An agent with a service account is your most privileged user
It runs unattended, and it takes instructions from whatever it reads, including log lines someone else wrote.
GAEZLA gives the AI the reach without the keys, and puts an operator's sign-off between every proposed change and production.
How a change happens
Four stages. When the change is ready, the operator reviews and approves it.
The AI does the legwork. The operator makes the call.
- investigating
The AI reads
Live state from the systems in scope, read directly, with the operator's own permissions and nothing more.
- proposed
It drafts the change
Every change is written up as a proposal for the operator to review. Nothing has touched your systems yet.
- awaiting approval
The operator decides
Approve in the console or in your MCP client, with multi-factor authentication if you require it. The proposal is fingerprinted at approval, so it cannot be tampered with on the way. If it is, it does not run.
- executed
It runs and is recorded
GAEZLA runs exactly what was approved, nothing more, and records who approved it, over which channel, and what ran.
Why it is different
Access, control and containment. You need all three.
Access without control is an incident waiting to happen. Control without access is a toy. Containment is what keeps a prompt injection from reaching anything the operator did not allow.
Access
Answers from every system, not six consoles.
- Each integration exposes the entire authorised API surface of the system, not a short list of canned tools.
- Captures changes across your connected systems, so a question about what changed has an answer.
- Uses the target catalogue to find a target and scope the right integrations for it.
- Reaches hosts through Linux and Windows agents that run only signed code.
Control
Nothing changes until the operator approves.
- Every change is drafted as a proposal. Nothing in GAEZLA can approve one, only an operator.
- The approve and execute calls refuse agents, routines and machine tokens. Approval can require multi-factor authentication.
- Many changes can be reviewed and approved as one batch, so a hundred changes is one decision, not a hundred.
- Integrations can run read-only or read-write. Even a credential with write rights changes nothing while the integration is read-only.
Containment
The AI has no access to your keys.
- The AI's code runs in a sandbox with networking switched off.
- The AI refers to credentials by name only. After approval, GAEZLA uses the value on the target. The AI never sees it.
- Secrets for a script are sealed to the enrolled host that runs the job, and scrubbed from its output.
See how it works: a 30-minute walkthrough, or a trial you can start today.
Zero trust, applied to the AI
The AI is an untrusted actor. GAEZLA treats it as one.
Zero trust says never trust, always verify. Zero-trust AI operations applies that to the AI: it can look and it can propose, and everything it proposes is verified by an operator before it touches anything. The definition is anopen specification on GitHub: five rules, mapped to NIST SP 800-207, with a checklist for anyone buying an AI operations product.
No network access for the AI
The code the AI writes against your systems runs in an execution sandbox with no network access. Its research tools reach the public internet, never your network. Your systems are reachable only through GAEZLA's SDK, with the operator's permissions.
No credentials for the AI
Integration credentials remain encrypted inside GAEZLA. Secrets from your vault are shown to the AI as names only; it cannot read their contents. When an approved job needs one, the execution worker reads it in memory, seals it to the target host's key and removes it from the output. The AI is never in that path.
No approval by machines
Only an operator can approve a change. The approve and execute calls refuse agents, routines and machine tokens. Multi-factor authentication can be required, so each approval goes to the operator's own device.
Nothing inbound to your network
Your appliance opens a reverse tunnel out to GAEZLA. No inbound port, no VPN, no firewall hole. Each system behind it sits behind its own access policy and its own login.
Memory is data, not orders
What the AI recalls from earlier cases is treated as information to verify, never as instructions to follow. Secrets are never stored in it.
Capabilities
What it does.
Start with an investigation, then use whatever else the job needs. Everything runs behind the same operator approval.
AI-assisted infrastructure investigation
Ask a question. The AI reads live state across your systems and comes back with evidence, not a guess.
A case works through each vendor's own API, reads the exact schema and queries live state and your configured repositories. Findings stay in the case. Any change arrives as a proposal for the operator.
Controlled infrastructure execution
Run signed code on enrolled Linux and Windows hosts and keep what comes back.
Each agent has its own identity, polls outbound for work and refuses anything unsigned. Code the AI writes reaches a host only after an operator approves it. Status, logs and output are kept.
Bring your own AI
Run on the Claude seats you already pay for, or any Anthropic-compatible endpoint.
GAEZLA checks each endpoint live and shows its errors as they are. Your own MCP client reaches the same SDK, with the same permissions and the same operator approval as the console.
Integrations
Every system through its vendor's whole API. Reads run directly. Changes wait for an operator.
Calls run with the operator's permissions, and credentials never reach the AI. Integrations you have not configured are invisible to it, and each can run read-only or read-write.
Appliance & app catalog
A hardened appliance on your site, encrypted at rest. It connects out to GAEZLA, so nothing connects in.
Systems behind it are reached over that reverse tunnel, each behind its own access policy. The app catalogue gets you started without running a stack of tools yourself, or you connect the systems you already have.
Asset ownership & rightsizing
Know who owns each asset, and size it from measured use instead of habit.
Filter assets by ownership state, run ownership validation and read its email history. Rightsizing reads utilisation from your monitoring and analyses it with an AI model you choose.
Alerts & routing
Take in alerts from any system over a webhook, classify them, route them, and see whether they arrived.
A machine-learning classifier decides whether an alert is routed, grouped, suppressed or escalated. When it is not sure, the alert goes to an operator for review instead of being dropped. Every delivery, to email, chat, paging or a webhook, is kept.
Infrastructure hardening & remediation
Scanner findings that keep their provenance, and hardening that records before and after.
Network and vulnerability scanner findings keep their asset, scanner and source run. Hardening benchmarks check every control. After the operator confirms, each setting is changed and recorded three ways: what it was, what the benchmark requires, and what it is now.
NIS2 & ISO 27001
Working records and a dated evidence calendar. Evidence is attached on purpose, not inferred.
Each framework gets a workspace for your answers, the gaps, the documents and which controls apply. Calendar series create dated occurrences where your team attaches evidence. Nothing is inferred from telemetry.
Just-in-time access
Lend server admin rights in on-premises Active Directory for a set time, approved on the approver's phone, and let the directory take them back.
Built on Microsoft's Privileged Access Management feature and its time-limited group membership. The multi-factor push goes to the designated approver, never the requester. Protected groups are refused, and Active Directory removes the membership itself when the time is up.
Before you ask
What people ask first.
Can we try it before we commit?
Yes. Start a trial from the pricing page, or book a 30-minute walkthrough and bring a real incident to talk through.
Is it worth the price?
Put a low number on a senior engineer's hour: $80 fully loaded. One hour a day saved for one person is about $1,700 a month. That pays for the base plan of any tier, Complete included, and troubleshooting is where those hours go.
Put your own numbers on itCan the AI change something on its own?
No. Every change it wants is a proposal, and only an operator can approve one.
Does the AI ever see our passwords?
No. It sees credential names and field labels, nothing else. After approval, GAEZLA uses the value on the host that runs the job and removes it from the output. The AI is never in that path.
Is this another chatbot on top of our tools?
No. A chatbot answers from what you paste in. GAEZLA reads live state through each vendor's own API, keeps the evidence in the case, and turns any change into a proposal the operator approves.
Why not just give Claude our logs?
Keep Claude. GAEZLA runs on the Claude seats you already have. The difference is like calling your car mechanic. Paste logs into a chat and you get the mechanic on the phone: a few quick guesses from what you described. GAEZLA is driving the car to the workshop. It reads the live systems, finds the fault from evidence, and drafts the change for your operator to approve. Slower by minutes, and right instead of plausible.
Building it yourselfCan we use our own AI client?
Yes. Connect Claude or any MCP client to the same SDK. Every change it proposes goes through the same operator approval as the console.
Plans
Three plans. The operator approval is in all of them.
Investigation and approved execution start in Essentials, not in a higher tier. Each plan includes everything in the one before it. Multi-factor authentication on approvals comes with Complete.
Investigate across your estate, bring your own AI, and run approved work on your own machines through enrolled agents.
Adds schedules that run unattended, vulnerability scans, asset ownership and rightsizing, and wider coverage: container platforms, security tooling and network appliances.
Adds alert routing, hardening with remediation, just-in-time admin access, vulnerability reporting, and the NIS2 and ISO 27001 workspaces.
GÆZLAGAEZLA
Why the name
A name for keeping watch.
GAEZLA comes from the Old Norse word gæzla: keeping, guardianship, or guard. We write æ as ae and keep the historic z. It suits an AI SRE that keeps watch over an estate and keeps its hands off it until someone says yes.
Bring one real incident.
Thirty minutes, no slide deck: see what the AI would read, what it would propose, who approves it and what gets recorded. Or start a trial and run it on your own estate.