Sinking the first shaft

Most data leaves the building before anyone decides it should. shaft takes the opposite view: the agent runs inside your network, next to the source, and only what you configure ever moves.

• Extract on-site, load on-site when the target is yours
• Push out only when the destination is remote
• Secrets never transit the control plane

The result is an ingestion layer you can reason about.