DevOps consultancies and agencies, governed changes on every client estate, with the record each client can keep.

For DevOps and cloud consultancies, agencies and small software vendors that change servers their clients own, or run a client’s stack for them. Each client is its own organization in Opafra, so what you did for one client never sits in another client’s record.

One organization per client

Four things stay with the client. Whatever else you run for others.

The details are on the security page. In short:

Its own organization: Every query for an organization's data is scoped to that organization, and a request for another organization's record answers as if it did not exist.
Its own keys: Credentials are sealed under a data key for that organization alone, and the ciphertext is bound to it.
Its own certificate authority: Each organization signs its own five-minute SSH certificates, and a certificate signed for another organization does not open its servers.
Its own audit log: The log is append-only, and its entries outlive the engineer who made them. The client can export it as CSV or NDJSON.

The record the client keeps

Approved for the exact revision. Kept by the client after you leave.

A change is a plan, drafted by your engineer or the AI composer, previewed on each host and approved for one revision. When the engagement ends, the client still has the record of what was changed, by whom, and on whose approval.

Fig. 1, change record for run #4f2a, revision 7

Change record /Patch nginx across prod, run #4f2a

Sample

@alex → AIDry-run passedApproved by @danaAudited · #4f2a

Origin: Drafted by the AI composer for @alex
Targets: web-01, web-02, web-03 in prod
Dry run: 3 hosts, 12 changes, 0 destructive
Approved: Dana Okafor at 14:32:07, for revision 7 only
Outcome: Completed on 3 hosts, 4 steps

Diffweb-02

/etc/nginx/nginx.conf+3/−2

 --- a/etc/nginx/nginx.conf
 +++ b/etc/nginx/nginx.conf
 @@ -1,7 +1,7 @@
  user  www-data;
−worker_processes  4;
+worker_processes  auto;
  pid /run/nginx.pid;
 @@ -31,6 +31,7 @@
      ssl_prefer_server_ciphers on;
−    ssl_protocols TLSv1.2;
+    ssl_protocols TLSv1.3;
+    ssl_session_tickets off;

The requirement it answersRegulation (EU) 2024/2690, point 6.4.2

“documented and ... tested and assessed in view of the potential impact before being implemented”

The point asks for documented, tested and assessed changes. The approval, bound to the revision that runs, is what Opafra adds on top.

Client onboarding and handover

Onboard a client from a template, hand over with the record.

Onboard from a template: Start each new client from a template of the plans you already run for others, not from an empty account, and change what differs.
Hand over with the record: When the engagement ends or a client takes the work in house, it keeps the audit log of what was changed, by whom and on whose approval, as CSV or NDJSON.

Working with Opafra

Carry Opafra to your clients.

Consultancies can refer or resell Opafra on written terms. See partners.

See it against a client estate.

Tell us how many client estates you change and how they review your work. You get a demo and your price in writing within one business day, with no call.

Get a demo