Skip to content
عربيRU
Book

Infrastructure operations platform

Seven tools to run your infrastructure? One console is enough.

Proxima Console brings inventory, live topology, monitoring, on-call paging, privileged access management (PAM), AI root cause, compliance and audit into one platform — for companies that run their own infrastructure, and for the teams that run it for them. Windows, Linux and Kubernetes, side by side.

Book a call Watch 75sStart a pilot
servers under management
1,000+
Kubernetes clusters
25+
enterprise clients
20+
on-call paging
24/7
Delever

Already running on Proxima Console

Early access

Delever runs its production infrastructure on Proxima Console, in early access.

Cloud Native Computing Foundation Silver MemberSilver MemberKubernetes Certified Service ProviderCertified Service ProviderThe Linux Foundation MemberMemberRed Hat PartnerPartner

Who builds it

6 yearsrunning enterprise infrastructure

Built by engineers, for engineers.

Proxima Console is made by the ProximaOps engineers who have spent six years running enterprise infrastructure around the clock. We built it for ourselves first, so every screen is shaped by what an engineer needs in the moment — not by a feature checklist.

  • Made by the people on call

    We carry the pager for 20+ enterprise clients. Anything that slows us down at 3 a.m. gets fixed, because we feel it first.

  • One page, not seven tabs

    Inventory, metrics, logs, access and audit for a host sit together, so the next question is one click away — not another login.

  • Context before action

    Alerts arrive with the blast radius and recent changes attached, and risky actions wait for an approval. Fewer guesses, fewer mistakes.

  • Works where you are

    Acknowledge a page by voice, drive the incident agent from Telegram, ask your AI assistant about the fleet. No laptop required.

What it replaces

Twelve jobs, one console.

Each tile is a tool category teams usually buy, run and reconcile separately. In Console it is a module over the same inventory, the same permissions and the same audit trail.

Why one console

Seven tools, one picture.

Why Proxima Console exists, and what changes when your whole estate shares one inventory — in 75 seconds.

The product

Everything an operations team needs, in one place.

Inventory & versions

The whole estate, reconciled

One agent per host reports inventory, packages, services and listening ports. Console reconciles it into a single inventory across every environment, and tracks how far behind every package is — with CVE and known-exploited overlay on the versions that matter.

  • Windows Server and Linux hosts, containers, Kubernetes, databases
  • Database roles: primary, replica, arbiter
  • Version currency with CVE and known-exploited overlay
  • Docker, nginx and PostgreSQL integrations

Topology

A map drawn from real traffic

Agents report the connections they actually observe. Console draws each environment as clients, entry points, applications and data, inside the provider and cluster they run on — and every line lands on the exact port it uses.

  • Built from observed traffic, not naming conventions
  • Provider boxes, cluster nodes and role columns
  • Lines land on the real port: 5432 postgres, 4222 nats
  • Live flow, idle services and internet paths on demand

Uptime

Checks that agree before they wake you

First-party synthetic monitors — HTTP, TCP, DNS, TLS-expiry and push-heartbeat — run from a fleet of probe locations. A monitor only goes down when enough consecutive failures agree across enough locations, so one bad vantage point cannot page anyone.

  • Five monitor kinds, scoped per client
  • Multi-location quorum on both time and space
  • Probe history per location, kept per client
  • Uptime history that never calls unmeasured an outage

Metrics, logs & Kubernetes

Metrics and logs, next to the host they came from

Every agent ships its host's metrics and logs, and every cluster reports CPU and memory used against requested, node by node, with its events. When a node spikes, the warning and the error line that explain it are one click away.

  • CPU, memory, disk and network per host, 6 hours to 7 days
  • Kubernetes: used vs requested by node, pods, workloads, events
  • Log Explorer by project, environment and host
  • Warnings and events beside the metrics that explain them

Alerting, on-call & paging

Early access

It reaches a person, or it tells you why not

Ingest the alerts you already have from Grafana, Alertmanager and webhooks, route them through escalation policies and on-call schedules, and page by Telegram or an actual phone call — press 1 to acknowledge. Severity is never invented: an alert that cannot be mapped stays unknown.

  • Webhook and pull-based alert sources with label mapping
  • On-call schedules, escalation policies, notification chains
  • Voice paging with keypad acknowledge and escalate
  • Dead-man's switch and readiness drills

Incidents & AI root cause

Early access

The cause, with its confidence

Every incident shows its blast radius — what the affected host depends on and what depends on it — and an AI answer with a confidence score, the evidence behind it and a recommended fix. Nothing runs until a person approves it.

  • Blast radius: depends on, and depended on by
  • Root cause with a confidence score and evidence
  • Verified, unverified or refuted — said plainly
  • Remediation runs only after Approve

Privileged access (PAM)

Reach the box without a VPN

Privileged access management built in: a browser terminal and brokered Kubernetes access, gated by per-environment roles and recorded end to end. Credentials are short-lived and issued on demand; the pc CLI gives the same access from a laptop.

  • Browser terminal, every session recorded and replayable
  • Short-lived SSH certificates and cluster tokens
  • Kubernetes access relay with its own roles
  • pc CLI for automation and port-forward tunnels

Compliance

A score you can defend

Rules evaluate continuously against every host and roll up to a per-client, per-environment score, mapped to frameworks such as the CIS benchmarks, with the failing checks listed underneath. Evidence, not a dial.

  • Continuous rule evaluation across the fleet
  • Framework mapping with score thresholds
  • Per-client and per-environment scoring
  • Top failures, ranked and drillable

Audit trail

An audit log you can prove

Logins, access grants, certificates, credentials and sessions land in one audit log. Entries are hash-chained, and an independent job verifies the whole chain every hour.

  • Actor, action, resource and source IP on every entry
  • SHA-256 hash chain across entries
  • Independent verification every hour
  • Recorded terminal sessions alongside the log

SIEM integration

Your audit log, in your SOC

Export Console's audit log as JSON or CSV together with the hash-chain integrity proof, so the SOC receives entries whose authenticity it can check. Alerts from your SIEM come into Console by webhook and page the on-call engineer. Real-time streaming to Splunk and Elasticsearch is in early access.

  • Audit log export in JSON and CSV
  • Hash-chain integrity proof in every export
  • SIEM alerts page on-call via webhook (early access)
  • Real-time stream to Splunk and Elasticsearch (early access)

Runbooks

Risk-tiered, so the dangerous ones wait

Every runbook carries a tier. Read-only runs immediately, operational asks the operator to confirm, and destructive waits for an admin's approval. Preview the plan, run it, keep the record.

  • Read-only · Operational · Destructive
  • Step-by-step execution plan with live status
  • Preview before execute
  • Execution record attached to the incident

Service desk, Jira & changes

The work, next to the cause

Tickets, logs and configuration change history live alongside the infrastructure they concern. Console connects to Jira Service Management through its API, so requests are raised, answered and approved from Console while Jira stays the system of record. Console also watches files and packages for drift, so the change that caused an incident is already attached to it.

  • Tickets with queues, kanban, projects and metrics
  • Jira Service Management API: requests, comments, approvals, attachments
  • Config changes detected automatically, with full file history
  • Changes linked to the incidents they caused

Fleet operations

A thousand agents that update themselves

Agents self-update through staged rollouts with a canary tier, so a bad release stops at the first ring instead of the whole estate. Configuration is pushed live and reconciled on a drift check.

  • Staged rollouts with canary and per-agent progress
  • Live config push with drift reconciliation
  • Agent tracing and self-log shipping
  • Credential rotation without redeploying

Model Context Protocol

Your infrastructure, in Claude, ChatGPT, Gemini or Grok.

Console ships an MCP server. Point any AI assistant that speaks MCP at it — Claude, ChatGPT, Gemini, Grok — and your entire estate becomes queryable in plain language — inventory, metrics, config changes, compliance failures, logs and alerts, scoped to exactly what the asking identity may see.

Early access

The same tools drive the incident agent: alert triage, correlation against recent changes, and a resolution memory that gets better the second time. Operators drive it from Telegram without opening a laptop.

  • Claude
  • ChatGPT
  • Gemini
  • Grok
  • Cursor
  • Console chat
See it answer questions about your infrastructure

You

Which hosts changed config in the last 24h and are now failing compliance?

AI assistant

Three hosts. All three regressed on the same rule after an unattended upgrade:

app-worker-11.northwindsshd_configPermitRootLogin
app-worker-12.northwindsshd_configPermitRootLogin
batch-runner-02.northwindsshd_configPermitRootLogin

The change landed at 03:14 UTC from the same package. There is a runbook that reverts it — want me to preview it?

Illustrative. Hosts and tenants shown are invented.

Built for regulated teams

Built for teams that answer to auditors.

Isolation is enforced in the data plane, access is brokered and recorded, changes wait for approval, and every administrative action lands in a verifiable audit trail.

Runs where your data has to stay

Deploy Console self-hosted — on your own servers or on-premises in an in-country data centre. Inventory, metrics, logs and audit records never leave your jurisdiction, so you can meet the data-residency rules that regulated financial institutions work under.

Download the brief (PDF)
Hard tenant isolation
Metrics are physically separated per client — not filtered by a query the application has to remember to add.
Environment-scoped roles
Grant a role against a single environment of a single client. Enforced across users, teams and service accounts, and fully audited.
MFA and passkeys
WebAuthn passkeys, TOTP, and Google Workspace SSO with domain restriction. Fail-closed by design.
Vault-backed secrets
Agent credentials, TLS certificates and stored secrets are issued and encrypted through HashiCorp Vault. Nothing durable sits in application config.
Broker-enforced agent identity
Every agent holds its own scoped credential. An agent cannot publish as another host even if it tries.
Changes only after approval
Remediations and destructive runbooks run only after a person with the right role approves them, and the approval is recorded.
Audit chain verified hourly
Audit entries are SHA-256 hash-chained; an independent job checks the whole chain every hour.
Recorded and replayable
Access grants, terminal sessions, runbook executions and administrative changes are recorded, replayable and queryable.

Pilot

Try it on one environment first.

Start small, on infrastructure you choose. We set it up with your team and review the results together.

Delever already runs its infrastructure on Proxima Console, in early access.

  1. 01

    Connect one environment

    Install the agent on the hosts of a single environment you pick.

  2. 02

    See it mapped and monitored

    Inventory, topology, uptime checks and compliance scores fill in as the agents report.

  3. 03

    Review findings together

    We walk through what Console found with your team and agree on next steps.

Start a pilotHow to get started: read the docs

Get in touch

See it against your own infrastructure.

A 30-minute walkthrough on your environment, not a canned demo — or tell us about the environment you would pilot on.

Book a call
sales@proximaops.io

Prefer not to pick a slot? Leave your details and we'll come to you.

No newsletter. We only reply about this.