llms.txt
# 3AM
> 3AM (3am.si) is an on-prem AI on-call engineer for regulated enterprises running legacy production systems that can't be rewritten. It diagnoses incidents, proves the root cause with read-only checks against live systems, and fixes them only after a human approves, inside the customer's own network.
## What it does
- Watches alerts from Prometheus/Alertmanager, Grafana, Splunk and Datadog, and pages from PagerDuty.
- Maps each alert to the affected service, owner, code and blast radius (from Git hosts, Jira and ServiceNow).
- Searches code and runbooks for likely causes, then confirms or rules them out with read-only checks against live systems (databases, Kubernetes, hosts).
- Proposes a fix bound to the evidence, dry-runs it, and asks for one-tap approval in Slack, Symphony, PagerDuty, phone or e-mail.
- Executes, re-runs the checks to verify, closes the ticket and writes the incident note.
## Safety and control
- Shadow mode by default: proposes and records, changes nothing.
- Autonomy is granted per service; raising it needs two approvers, lowering it is immediate; a global halt stops every action.
- Runbooks and past incidents can suggest a cause but can never authorise an action; only live evidence can.
## Security
- Runs on the customer's hardware (Helm chart or single host); air-gap bundle available. No inbound ports; outbound only to tools the customer connects.
- No incident data is sent to 3am.si. The only call to us is a licence check to Warden every six hours (licence, install fingerprint, version, a signed count of services and investigations); offline mode never makes it.
- Open-weight models run on the install's GPU, or behind a model endpoint the customer chooses (their own, or a hosted one).
- Secrets, tokens, keys and card numbers are redacted before anything is written.
- Every signal, check, approval and action is recorded in an append-only, hash-chained ledger with signed segments, verifiable independently and exportable to a SIEM.
## Measured results (production-grade core-banking test estate, live fault injection)
- 0 harmful actions; median 3m 42s from page to verified fix.
## Documentation
- Docs index for LLMs: https://docs.3am.si/llms.txt (every page also as Markdown: add .md to its URL)
- All docs in one file: https://docs.3am.si/llms-full.txt
- Docs home: https://docs.3am.si/
## Links
- Home: https://3am.si/
- For banks: https://3am.si/banking
- Security: https://3am.si/security
- Book a demo: https://3am.si/demo
