Standby
Monitor every server. Page the right person. Prove it was handled. One agent for Linux and Windows, with monitoring, on-call, security and compliance in one place, and a status page that stays up when yours do not.
Every machine, under control.
Monitoring, on-call, security and compliance in one install on your own server, with one agent for Linux and Windows, servers and laptops alike, a service desk for your team, the datacenter itself, and a status page that stays up when yours do not.
- Monitoring. Metrics and logs from your Debian, Ubuntu, RHEL, Alpine and Windows machines, dashboards you lay out yourself, checks from outside, service health and SLOs.
- On-call. The right person is paged by voice, text or the app, and a storm from one source is capped instead of paging over and over.
- Security. Vulnerabilities on what is really installed, patching a few machines first, a web firewall and a recorded terminal.
- Compliance and a Trust Center. Controls scored from what your machines do, auditor packs, and one public page that shows customers where you stand.
One agent, every machine you run
Debian, Ubuntu, RHEL, Alpine, SUSE and Arch, installed with one command. Debian and Ubuntu report everything, including installed software matched against the vulnerability feed; other distributions report less, and each machine’s page says what.
The same agent on Windows: metrics, logs, missing updates and installed software, for servers and endpoints alike, with a desktop app that rings until someone acknowledges.
Every machine’s page states what the agent collects on that system, so a blank chart is never mistaken for a quiet one.
Your monitoring, your way
Drag charts into a grid, resize them, and keep your own or share them with everyone. Metrics and logs land in your own install, on your own server.
Web, port, ping, certificate and DNS checks from probe servers you place where you like. With two or more locations, a public incident opens only when at least two agree.
A blank chart means a machine is not reporting, never that it is quiet. Missing data is never drawn as zero.
How Standby is built
One install on your own server, one agent on every machine, probe servers where you place them, and a status page on a server of its own. Press play to follow the parts, or pick a scenario to see what still happens.
The agent on each Linux and Windows machine calls out to your install with metrics, logs, services and installed software. Nothing connects in to a machine. KStack sends its alerts the same way.
Probe servers watch your sites the way a customer would, and the vulnerability feed that comes with your licence is matched against what each machine really has installed.
Metrics, logs, incidents, findings and compliance evidence stay in your own install. An alert rule that fires opens an incident.
The escalation chain pages by voice or text through your own telephony account and rings the desktop app, then moves to the next person if nobody acknowledges.
The status page updates from its own server, and the incident, who was paged and what was done are already evidence for the auditor’s pack.
Every part, explained (14)
- Person on call (voice, text or the app)
- Whoever the rota says. Standby pages them and moves to the next person in the chain if nobody acknowledges.
- Telephony account (yours: voice and text)
- Calls and texts go out through your own telephony account, so the numbers, the bill and the records are yours.
- Desktop app (Windows, rings until seen)
- A desktop app for Windows with tray alerts and an alarm that keeps ringing until someone acknowledges the page.
- Your auditor (a read-only pack)
- Gets a signed, expiring link to the evidence pack, or a portal that shows only their engagement. Controls were scored from what the machines did.
- Your customers (read the status page)
- They subscribe by email, feed, Slack, Discord or Teams, and see your brand, never Standby’s.
- Console and API (what your team logs into)
- The console your team uses and the API everything else talks to: agents, probes, integrations and your own scripts.
- Metrics and logs (evidence too, on your server)
- Every metric, log line, incident, finding and compliance control lives in your own install. Nothing is sent to lbreeze except the licence check and what the vulnerability feed needs.
- Incidents, on-call (escalation chains, rotas)
- Alerts become incidents; the escalation chain picks who is on call by severity and label, pages them, and moves on if nobody acknowledges. When a large part of your fleet goes quiet at once, you get one alert, not one per machine.
- Status page (on a server of its own)
- A public status page in your brand on a separate server, so it keeps working when the systems it reports on do not, including Standby itself.
- Linux servers (agent installed)
- The agent runs on Debian, Ubuntu, RHEL, Alpine, SUSE and Arch. On Debian and Ubuntu it reports everything and is matched against the vulnerability feed by the exact versions installed; on the others it reports less.
- Windows machines (servers and laptops)
- The same agent on Windows: metrics, logs, missing updates and installed software, for servers and endpoints alike.
- KStack servers (alerts in, uptime out)
- KStack alerts arrive as incidents, and Standby reports each server’s availability back so KStack can show it next to the server.
- Probe servers (checks from outside)
- Small probe servers you place wherever you like. They check your websites, ports, certificates and DNS the way a customer would, and with two or more of them, a public incident opens only when at least two agree.
- Vulnerability feed (comes with your licence)
- On Debian and Ubuntu each machine’s package list, and on Linux its running services, application dependencies and kernel version, are matched against the feed that comes with your licence, so findings are about what is really installed.
Paging that reaches a person, not a channel
Calls and texts go through your own telephony account. A Windows desktop app adds tray alerts and an alarm that rings until someone acknowledges.
- Escalation chains. Matched by severity and label. A step can page several people at once, and the first to acknowledge stops the rest.
- Rotas, swaps and overrides. On one coverage board that shows uncovered time in red. Silences and maintenance windows keep planned work quiet.
- No alert storms. When a large part of your fleet goes quiet at once you get one alert, not one per machine, and a burst from one source is capped. A critical alert is never swallowed.
- Rota pay and time off. On-call pay that counts overlapping time once, leave, and a payroll export.
Incidents, runbooks and change
A timeline of alerts, notes and commands, the runbook that applied, and the record of what was done.
Playbooks for the common faults, suggested on the incident when they apply, with response templates for the first message out.
Blast radius, two-person approval and a rollback plan before a change touches a machine.
It spots clashes with maintenance windows and gaps in on-call cover, and sends a morning digest.
Advance notice, one window per server per month, and a deadline for security fixes, written into policy.
Team chat with a channel per incident, and self-hosted video for the call.
Audit evidence from what your machines actually do
Standby gathers the evidence and keeps it current. Auditors still award the certificate; what goes away is the month of screenshots beforehand.
- The frameworks you answer to. ISO 27001, SOC 2, NIS2, DORA, GDPR and UK GDPR, PCI DSS, Cyber Essentials, HIPAA, the Cyber Resilience Act, the EU AI Act, ISO 42001, NIST and more. Adopt the ones you are measured against.
- Scored all the time. Controls are scored from what your machines are doing. Controls about people and process are confirmed by your team, each with an owner and a review date, and one control counts across every framework it applies to.
- Ready for the auditor. A Statement of Applicability and evidence packs as PDFs from the live state, handed over as read-only links that expire, or an auditor portal that shows only their engagement.
- The paperwork, started for you. A policy library to adapt, a risk register with a heat map, internal audits, management reviews, training courses with certificates, supplier risk, a breach register and data-subject requests.
Security on what is really installed
On Debian and Ubuntu, findings match the exact versions installed, known-exploited first, with the upgrade that closes each one. On RHEL and SUSE you see the security fixes waiting; on Windows the missing updates.
Dependencies of the code your customers run, and WordPress core, plugins and themes, with a bill of materials per application.
Failed sign-ins, injection attempts and web-shell detections in one feed, with a ranked queue of what needs you first. Block an address or run a scan from the alert; isolating a machine takes a second person’s approval, and every action is recorded.
Apply a policy to every server or a group, and hear when a server’s rules drift from it.
On Debian and Ubuntu, updates go out in maintenance windows to a few machines first and stop at the first failure.
Open a terminal on a Linux server through Standby, with every session recorded and no remote login to any server.
Up when it matters
A public status page in your own brand, on a server of its own, so it keeps working when the systems it reports on do not.
- Honest status. An incident is marked resolved only after the alert has stayed quiet for a while, and reopens if it fires again.
- Uptime and SLA. Per-minute uptime bars, SLA targets per component, availability reports, badges and an embeddable widget.
- Subscribers. Email with double opt-in, a news feed, and Slack, Discord and Teams channels. Your brand, with no Standby name on it.
Pricing
- ✓ Per node, per month
- ✓ From twenty-five nodes
- ✓ Monitoring, on-call, security and compliance included
- ✓ A status page that stays up during an outage
- ✓ A removed machine stops counting
- ✓ Signed updates while the licence is current
Prices exclude VAT.
Frequently asked questions
Does Standby make us certified?
No. Standby gathers and organises the evidence; an auditor or certification body awards the certificate. What it removes is the scramble before an audit.
What runs where?
Standby runs on your own Ubuntu, Debian or Alpine server, the status page on a second server of its own, and metrics and logs on a telemetry server you add from the Telemetry page. The agent covers Linux and Windows.
What does Standby send to lbreeze?
The licence and update check sends your host name, how many machines are enrolled and an install fingerprint. To match vulnerabilities to what is installed, each machine’s host name, operating system, package list, application dependencies, running services and kernel version go to the vulnerability service that comes with your licence. Nothing else leaves your install.
Does it work with KStack?
Yes. KStack alerts arrive in Standby as incidents, and KStack shows the availability Standby reports for each server. Standby also watches servers KStack does not run.
Is there a free trial?
No. Start with the twenty-five machines you would miss most, and we will walk you through it on a call first if you like.
What if my licence lapses?
Paging, monitoring and the status page keep running. Adding machines, updates and the vulnerability feed need a current licence.
Want to see it working first?
Book a walkthrough with our team. Tell us what you run today and we will show you the parts that matter to you.
Start with Standby
£7 a node a month, from twenty-five nodes, with every module included. Prices exclude VAT.
Subscribe to Standby