SkyQon admin console

The SkyQon Digital Trust Center Administration Guide (13 parts — orientation, architecture, identity, monitoring, acting on findings, evidence, integrations, operations, administration, troubleshooting, reference, roadmap) and the five beginner guides are documents in the repository, not pages on this host — no route serves them, so there is deliberately no link here to click. They are at docs/admin-guide/ and docs/guides/. Publishing them behind the console is separate work; until then, treat the repository copy as the authority.

Provision a customer workspace in a few guided steps — identity, initial admin login, plan, add-ons and domains. The wizard creates everything directly and writes an audit entry; no SSH needed.

Each tenant’s window follows its plan by default (Free 30d · Starter 6mo · Pro 1yr · Growth 2yr · Business 3yr), or a per-tenant override set from the Tenants tab. This global value is the fallback for tenants whose plan has no mapping. Floored at 30 days so evidence-adjacent signal isn’t lost; on/off stays an ops decision.

Pin one tenant to a specific external-scan interval, independent of its tier default. Rejected below the tenant's plan floor. Clear removes the override so the tenant falls back to its tier default / file. This touches only the external scan — the other per-scanner cadences are set from the Tenants tab's schedule editor.

OV/EV identity cross-checks for Belgium run against the official KBO Open Data Full extract instead of a live API. Download the monthly ZIP from the KBO Open Data portal (free registration) and upload it here as-is — the file is sliced into chunks client-side (Cloudflare caps single requests at ~100 MB), reassembled on the server, and imported in the background. BE verifications switch to the new extract the moment it goes active; until a first upload, BE certs stay unsupported.

Post a banner to every tenant — a planned maintenance window, an incident, or an announcement. It shows on the dashboard (all signed-in users) and, when audience is Everyone, on the login screen too. A notice is live while Active is on and the current time is inside its window (leave the times blank for "now / no end"). No restart needed — live on save.

Newest first. “Live” = currently shown to tenants.

Request-to-buy submissions from tenant admins. Fulfil by manual invoice, then mark won.

Self-serve signups grouped by the surface that sent them (?src= on /signup, e.g. ncsc for the NCSC Mail Check / Web Check displacement landing). Shows how far each campaign converted: Free → Trial → Paid. Direct / operator-created tenants have no source.

Every action SkyQon staff took on a customer's account — plan and subscription changes, add-on grants, the pause switch, scan-cadence overrides, tenant erase and export, platform-settings changes. Written to platform_audit_log (GDPR Art. 30, retained even after a tenant is hard-erased) and, until now, readable only by opening the database by hand.
Staff changes to a customer's people — logins, roles, deactivation, password resets — also appear on that customer's own Activity page. The account-level changes listed here do not; whether they should is an open product decision.

The temporal companion to Acquisition: how self-serve trials progress through activation — signup → domain → first scan → alert → report → upgrade intent — plus time-to-first-value and which live trials have stalled (no completed scan after a few days) so you can reach out before they lapse. Derived from existing activity; no tracking pixels.

Infra-coupled settings that deliberately stay in .env on the box (change there + --force-recreate). Shown here so this page is the full picture.

Read-only view of the database HA cluster, as seen from this app instance (which always reaches the current leader via its node-local pgproxy, so the app DSN never changes on failover). Failover is automatic. Patroni + etcd (Phase C) promote the replica and flip the Cloudflare origin with no operator step — measured RTO ≈ 40 s at the database and ≈ 50–80 s user-facing, RPO ≈ 0. Do not hand-promote a node: under Patroni that risks split-brain. To inspect cluster state use patronictl list on any database node; recover.sh / rebuild-replica.sh are break-glass only, for when Patroni itself is broken.

Every subsystem the scheduler runs. Each one isolates its own errors so a single broken component cannot stop the others — which also means a component can fail every run without affecting /health or anything else on this page. This is where that shows up. Degraded means it has failed at least once in a row; Failed means it has reached the alert threshold and the operator has been paged.

Free, short-lived test certificates for AI agents that customers are building, signed by the sandbox's own root (not SkyQon's production PKI). Customers request them from Machine identities → Agent identity sandbox, or through the API. Every change here is written to Staff activity.

The self-hosted Certificate Transparency reader (certspotter on ctdashboard) and every public log it follows. Each check below is the same test the ct_reader watchdog runs, shown with its evidence — so a green panel is a confirmation, not just the absence of an alarm. Figures are what the reader reported in its last heartbeat (every 15 minutes).

Re-check now re-runs the checks here and updates Component health immediately. The other buttons are carried out on the reader host: it picks them up within about a minute and reports back below. Quarantine or release a single log from its row in the table.

Holding the pager silences escalation for a known condition — a CT log being throttled, or planned work on the reader host. It does not change the verdict: the checks above keep running, Component health keeps recording the failure, and this panel keeps showing red. Every hold expires on its own (24 hours maximum).

No actions yet.

Every login across all tenants. Role changes take effect on the user's next sign-in; per-tenant login management (create, deactivate, reset) lives in the tenant's detail view.