FOR TEAMS THAT KEEP DATA AT HOME
Your data runs in your Azure.
Connect your Azure subscription, build a landing zone in it from one window, and the parts of OpenX that hold your data run inside it: data stores, identities, app secrets and record. What sits with Fathym is listed on the security page.
New to OpenX? Key terms →
YOUR LANDING ZONE · YOUR SUBSCRIPTION
- Resource group
- Everything OpenX builds, in one place
- Storage account
- Your data, in your region
- Key Vault
- The workspace's app secrets
- Log Analytics
- Logs you can query
- App Insights
- Health you can watch
Built from one window. Safe to run again.
CONNECT, BUILD, THEN EVERYTHING ELSE
Your subscription, set up from one window.
Status you can read
Each connection card shows the subscription, the tenant, its health, and whether Fathym manages it or you do.
No false alarms
When a check cannot run, the badge says "Couldn't check", not "invalid".
Keys that do not quietly break
A save that would blank a connection's key is refused, and the card points you to the fix: renew the connection.
A landing zone from one window
A resource group, storage account, Key Vault, Log Analytics and Application Insights, built in your own subscription, which it tags, and can put under an Azure residency policy when you ask for one.
Safe to run again
It registers the Azure resource providers it needs first, and running it again picks up what is already there.
A home for app secrets
Relay passwords, Stripe keys and app secrets go to your Key Vault. The workspace keeps only references.
IF DATA LEAVING YOUR TENANT IS A NON-STARTER
For teams whose data stays where it is.
IT and cloud teams
Keep plant, lab and customer data out of a vendor's tenant, under your own policies.
Operators who have lived through a silent expiry
Connection health sits on the card that uses the key, with the fix right there.
Security reviewers
The workspace's app secrets in a vault you control, and the resources it builds in a subscription you can open.
INSTEAD OF A VENDOR TENANT
Your cloud is where the rest of OpenX lands.
Building the landing zone is the start, not the point. Once it exists, App Identity, Provenance, Communications and more open from the Environment menu, and each one lands in your subscription.
- Data, identities, app secrets and the record live in your own Azure.
- Status that tells "couldn't check" apart from "broken".
- A save that would blank a key is refused before it happens.
YOUR FIRST WEEK
From an empty subscription to a working workspace.
First week in your tenant
- 01Connect your Azure subscription.
- 02Build the landing zone from one window.
- 03Turn on App Identity and Provenance. Each lands in your subscription.
One vault for the workspace
- 01Set up a mail relay, a Stripe account and an app.
- 02Their secrets go to your Key Vault.
- 03The workspace keeps only references to them.
Setup with an assistant
- 01An AI lists your Azure directories and subscriptions over MCP.
- 02It proposes the settings.
- 03A person connects the cloud and accepts.
WHERE LOCATION IS A REQUIREMENT
Your data, under your policies.
LIFE SCIENCES
Records in your own cloud reduce, but do not remove, the third-party scrutiny regulators ask for.
MANUFACTURING
Plant data in the company's Azure, under its own policies.
ENERGY AND UTILITIES
Meter and site data kept under the utility's own cloud policies.
Fire us, keep running.
On a subscription you bring, the resources OpenX builds, from data stores to your record, stay in it and keep running there. They are yours.
GO DEEPER
MORE OF OPENX
AI governance →
Over MCP, AI proposes and a person accepts. Only a person deploys.
OpenX MCP Server →
A few tools let any MCP-capable AI read your workspace and propose changes to it.
API Manager →
Your workspace is already an API. Decide who may call it and what each caller reaches.
Warm queries →
Save a question over live data and serve the answer to dashboards, apps and AI.
Provenance →
A record you can prove, kept in your own cloud, with corrections and signatures.
Databases →
A Cosmos DB store in your subscription, with a governed API for each container.
App Identity →
Your own sign-in directory, identities for your jobs, and access in one window.
Licenses →
Sell what you build on your own Stripe, and turn a subscription into a plan's rights.
IoT →
IoT Hub and Data Explorer in your Azure, feeding queries, APIs and AI.
Communications →
Send mail through your own relay, with the password in your vault and sends on record.
App building →
Data, sign-in, access, an API and billing: your app's backend, already there.