Skip to main content
    Meet us at Open Source in Finance Forum (OSFF) New York, Convene Brookfield Place, November 4 to 5.Book a meeting
    Book a briefing
    Reign OpsSecure source control

    Keep source control inside the boundary you choose.

    Reign Ops runs GitHub Enterprise Server, GitLab Self-Managed or Bitbucket Data Center as a dedicated single-tenant instance inside the boundary you choose. Your repositories, secrets and pipeline artifacts stay there; we carry the operations.

    Available today Book a 30-minute operations briefing Deployment options →

    A single-tenant dedicated instance, in your own AWS or Azure account or in infrastructure iTmethods operates. Both available today; Google Cloud is planned for 2027. Air-gapped and sovereign deployment are supported.

    What is held in boundary
    Inside your boundary Repositories and history Secrets Pipeline artifacts None of it moves Gateway Cursor Copilot Claude Code Codex Open-weight models Recorded to agreed destinations
    Inside your boundaryRepositories and historySecretsPipeline artifactsNone of it moves
    Coding toolsCursorCopilotClaude CodeCodexOpen-weight modelsGateway

    Recorded to agreed destinations

    Gateway sits at the boundary for coding-tool interactions routed through it.
    GitHub Enterprise ServerOperated by iTmethods GitLab Self-ManagedUltimate or Premium, operated by iTmethods Bitbucket Data CenterOperated by iTmethods
    Platforms supported today

    We operate and support three source-control platforms.

    GitHub Enterprise Server, GitLab Self-Managed and Bitbucket Data Center are supported today. Responsibilities are written down before anything is deployed.

    GitHub

    GitHub Enterprise Server

    GitHub Enterprise Server, operated as a single-tenant dedicated instance inside your authorization boundary. Actions runners isolated per environment with short-lived OIDC tokens.

    Who it suits. Teams already on GitHub who need the estate inside their own boundary.
    Available today Managed GitHub Enterprise Server →
    GitLab

    GitLab Self-Managed

    GitLab Ultimate or Premium, operated as a single-tenant dedicated instance against your own identity provider. Runners isolated per environment, CI/CD variables under the same identity boundary as the platform.

    Who it suits. Teams who want the pipeline, the registry and the scanning in one product.
    Available today Managed GitLab →
    Bitbucket

    Bitbucket Data Center

    Bitbucket Data Center, operated as a single-tenant dedicated instance alongside the rest of an Atlassian estate. Atlassian has said Bitbucket Data Center will not reach end of life; standalone licenses end on 28 March 2029, after which it is sold through a Hybrid License.

    Who it suits. Atlassian estates staying self-hosted, and teams who want source control to sit next to the tracker rather than away from it.
    Available today Managed Bitbucket Data Center →

    Running something else? Bring the platform, version, deployment model and support requirement. iTmethods will confirm whether it fits the current service or needs a separate implementation scope. Tell us what it is →

    Where your code and delivery controls run

    Deployment is one part of the source-control decision.

    Feature requirements, existing licenses, engineer familiarity and deployment needs all shape the choice. iTmethods operates supported source-control platforms as dedicated single-tenant instances in your cloud account or in infrastructure we operate, including air-gapped and sovereign deployments.

    01What the repository holds
    Every secret, every architecture decision, every business rule, and every prompt a coding assistant has ever been issued.

    A breach at that layer is not a breach of a tool. That makes hardening the platform a risk decision, not only an engineering one.

    02What reads it now
    EngineersCoding agentsCI pipelinesSecurity scannersDependency bots
    All of them reach the same substrate, at machine pace.

    Each one is a distinct identity that has to be accounted for.

    03Whose posture it carries
    Outside your authorization boundary it carries the platform vendor’s security posture, not yours, and you cannot audit what you cannot reach.
    04The usual price of that control
    Operating it yourself.

    You keep the control of a self-managed instance; iTmethods carries the operations.

    Lands on your platform team
    UpgradesRunner fleetBackupsSecurity postureAudit trail
    Reign Ops Operated by iTmethods, inside your boundary

    iTmethods does not custody customer code, secrets or pipeline artifacts. The substrate is operated by iTmethods. The artifacts are owned by the customer.

    What Reign Ops applies on day one

    Named controls, applied at deployment.

    The identity boundary is yours.

    Your identity provider at the platform edge, on the protocol you already run. Group and sub-group inheritance enforced rather than reimplemented.

    Runners are isolated per environment.

    Short-lived tokens, no long-lived registration secrets, and no shared execution surface between environments that are not supposed to see each other.

    Audit and operational telemetry are routed to the destinations agreed for the deployment.

    Those destinations may include iTmethods operations tooling and customer systems.

    Patching runs on a cadence.

    Substrate, runner fleet and dependencies, on a cadence matched to upstream releases. Version currency is our work rather than something waiting for a quiet week.

    The full control set is published. The named controls, with deployment topology diagrams and sample policy excerpts. A selection is summarized on each platform page; the complete deliverable is the hardening sheet. How we handle security questionnaires →

    Beyond SOC 2 Type II for Reign Ops, no other certification or accreditation is claimed. What each framework asks for, and the limits on what any supplier can tell you about your own position, is set out on regulatory alignment.

    The AI coding tools

    The question is not which tools. It is what they can reach.

    Copilot, Cursor, Claude Code, GitLab Duo and Atlassian Intelligence can be routed through Reign Gateway. Reign Gateway applies policy and records the model and tool interactions sent through it.

    What the boundary adds
    For each model or tool interaction sent through Gateway: the identity that made it, the policy that applied, the decision taken, the model that answered, and the time it happened. Applied at the point the call is made rather than asserted in a document beside it. You author the catalog of tools the organization sanctions; the boundary enforces it.
    The part worth being precise about. This governs the coding tools your own engineers run. It is not a claim that those tools are safe, and it does not make an unapproved model approved. It means a reviewer can reconstruct what an agent asked for, what it was allowed, and what came back, on the same substrate as the code it touched. How the boundary works →
    FAQ

    Questions buyers ask

    Where does the code actually live?
    In a single-tenant dedicated instance inside your authorization boundary, your own AWS or Azure cloud account, or infrastructure iTmethods operates. iTmethods operates that substrate and does not custody your code, your secrets or your pipeline artifacts. There is no multi-tenant or shared option, and there is no tier of this where your code sits alongside somebody else’s. Your repositories and intellectual property, your code review, branch protection and push policy, and the catalog of AI coding tools your organization sanctions are customer decisions.
    Does moving platform mean re-platforming the pipelines?
    Not wholesale. A scoped readiness assessment inventories projects, groups, variables and runners and sizes the migration, then a phased cut-over lands the estate on the new substrate. Group and sub-group inheritance is preserved across the move, and pipelines are not rewritten mid-flight. Where platform-specific syntax or integrations differ, the assessment names what needs rework before the cut-over.
    What happens to the AI coding tools our engineers already use?
    They keep working. Where they are routed through Reign Gateway, you author the catalog of what is sanctioned, the boundary enforces it, and it records what each interaction asked for, what applied to it and what came back. Nothing here requires your engineers to change tools.
    Which deployment shapes can we have?
    A single-tenant dedicated instance, in your own AWS or Azure cloud account or in infrastructure iTmethods operates. Both are available today and both are single tenant. Google Cloud is planned for 2027. Air-gapped and sovereign deployment are supported. Deployment options →
    Can we see the controls before we commit to anything?
    Yes. Each platform page carries five of the twelve controls in full, and the hardening sheet for that platform carries all twelve with sample policy excerpts. Nothing on this page needs a conversation before you can read it.
    AWS Advanced Tier Services Partner AWS Validated Managed Service Provider SOC 2 Type II on Reign Ops
    Two decades operating critical infrastructure for regulated enterprises.
    Next step

    Tell us where your source control runs today.

    Which platform, roughly which version, and what is forcing the question. We will come back with what we would operate, what stays with your team, and what we would leave alone.

    Book a briefing Back to Reign Ops →