How Vigil works

Vigil has three parts: an agent that runs in your cloud, the platform that stores and analyzes what it collects, and your portal + dashboards where you see it.

1. The agent (in your account)

For cloud infrastructure (AWS, Azure, GCP), a lightweight agent is deployed inside your own account and connects back to Vigil with keyless, least-privilege access — an IAM role, a managed identity, or an attached service account. No long-lived keys are handed over.

The agent has three jobs:

Sidecar (always-on): collects live metrics and forwards them for dashboards.
Collector (scheduled, roughly hourly): discovers your resources and gathers cost and inventory data.
Security scanner (scheduled, daily): runs configuration and posture checks.

Some sources are agentless — DigitalOcean, Microsoft 365, and Google Workspace connect through a scoped API token or admin-consented app instead of a deployed agent.

2. The platform

Everything the agent collects flows to Vigil’s platform, where:

Metrics are stored in an isolated, per-customer time-series store and rendered as dashboards.
Findings, costs, and evidence are stored, scored, and tracked over time.
A senior team reviews what matters and acts on it.

Your data is kept separate from every other customer’s.

3. Your portal & dashboards

Portal (app.vigilcloud.io) — scores, findings, cost summaries, compliance status, and downloadable reports.
Grafana dashboards (dashboard.vigilcloud.io) — deep-dive metrics and trends.
Alerts — routed to Slack, PagerDuty, or email.

Data flow at a glance

Your cloud account                     Vigil platform            You
┌───────────────────────┐              ┌──────────────┐         ┌──────────────┐
│  Agent (keyless)      │  metrics ──▶ │  Metrics DB  │  ─────▶ │  Grafana     │
│  • sidecar (live)     │              │  (isolated)  │         │  dashboards  │
│  • collector (hourly) │  findings ─▶ │  Findings /  │  ─────▶ │  Portal +    │
│  • security (daily)   │   cost/      │  cost / evid │         │  reports +   │
└───────────────────────┘   evidence   └──────────────┘         │  alerts      │
                                                                 └──────────────┘

What this means for you

Low footprint: the agent is small and runs on your existing cloud.
Data sovereignty: raw infrastructure data stays in your tenant.
Fast to value: once deployed, the agent starts posting data within about an hour.

Next: Quick start