Alerts in with hostnames, emails, API keys.
Only tokens ever leave.
Most AI-powered ops tools ship your raw hostnames, emails, and API keys to OpenAI as training-accessible context. Culprit tokenizes at the edge — placeholders only leave your network. Logs, notifications, LLM prompts all see <HOST_a3f9>, never db-prod-7.acmecorp.internal.
Memory across incidents.
Most AI ops tools see one incident at a time, then forget. Culprit cites the top similar prior fixes on each service — the LLM reasons against your team's resolved cases, not from scratch. Mark an analysis wrong and it stops showing up next time.
01 / 03 — Tokenization
Built to never see your data.
Your 3am database alert contains a real hostname, a real IP, maybe a real username in a stack trace. Most AI-powered ops tools ship that text straight to OpenAI. Culprit encrypts payloads at the edge and tokenizes them before any downstream system — log lines, notifications, LLM prompts see placeholders only. Rehydration is scoped to authenticated users with matching tenant scope.
How tokenization worksWhat Culprit sends
alert: auth_failure host: <HOST_a3f9> email: <EMAIL_c44b> ip: <IP_b217> auth: Bearer <APIKEY_d8e9>
c4a81b. Token validator rejects requests issued > 30s ago.02 / 03 — Correlation
AI clusters noise into incidents.
Correlation happens on tokenized events, so the model never sees raw customer names, IP addresses, or ticket contents. You see a single incident with a ranked root-cause summary — not a page of alert notifications.
03 / 03 — Aligned incentives
$49 per service, flat.
Most ops platforms charge per alert or per event — which trains you to sample, throttle, silence. Your AI gets a narrower signal, your correlations get worse, and your bill spikes exactly when you can least afford a distraction: during an outage.
Culprit charges $49 per service connection, flat. There's no per-event meter and no tier jump on heavy days — outage weeks cost the same as quiet ones. The more signal you send, the sharper your incident graph; we're aligned with you sending more, not less.
per service · per month
Flat · No overage · No caps
04 — Frequently asked
Questions we answer on every call.
$49 per service per month, flat. No metered overage and no tier jumps from heavy days — we bill for the connection, not the data volume. Sustained volume above ~500,000 events per service per month is a fair-use envelope where we'd suggest an Enterprise conversation, but almost no one hits it.
Your payload is encrypted at our edge the moment it arrives, then tokenized — hostnames, IPs, usernames all become placeholder IDs. Only the tokenized version flows to correlation, storage, LLM analysis, and notifications. Real values never leave your tenant in plaintext unless an authenticated user with matching tenant scope explicitly reveals them. Compliance details (SOC 2 / HIPAA / BAA) available on request.
Point your existing alerting tools at our ingest endpoint — anything that can POST JSON over webhook. Setup runs ~15 min per service.
Encrypted payloads live in a vault. We store tokenized copies of events for correlation and display. Your PII never leaves your namespace in plaintext — not to logs, not to notifications, not to LLMs.
Flat pricing, tokenization at the edge, and AI correlation as a native capability rather than a paid add-on. Your sensitive data never leaves your tenant — we correlate patterns, not identities.
build b46460aupdated 2026-05-13no trackersno analyticsno third-party scripts