trstctl keeps every machine credential issued, renewed and revoked on time. probectl watches your network from your own vantage point. Both run where you run, and nothing leaves your infrastructure unless you send it.
TLS and SSH certificates, secrets, API keys and tokens, workload and AI-agent identities: found, issued, renewed, revoked and audited, with private keys sealed in a separate signer process.
For platform and security teams, and for MSPs running many customers' credentials.
Synthetic tests, BGP and routing, flow, device telemetry and eBPF, folded into one incident that cites its evidence.
For network and platform teams, and for MSPs serving many tenants.
Both products are source-available, so the code behind each promise is there to read.
Runs where the internet doesn’t: offline install bundles, egress that fails closed. trstctl · probectl
Every change lands in a tamper-evident audit trail you can inspect.
License checks are local signature math. There is no phone-home.
OpenAI’s vetted-defender program.
Both products’ code is reviewed with OpenAI Daybreak, the vetted-defender program the founder was approved for in 2026.
Both consoles run in your browser on sample data. No signup, no backend.