FAQ
Short answers to the questions that come up most, with links to the long ones.
Product
Does my data go to you? No. Investigations run on your machines against your infrastructure. Ticket text and gathered evidence go to your LLM provider using your key. Query results, reports, Console threads and usage totals never leave the desktop. See Security model.
Can the agent change anything in my systems? No. Write protection is enforced at the MCP server level, not by prompting. Use read-only credentials as well, so the guarantee does not depend on one layer being bug-free — and note that a few providers (BigQuery, New Relic, Zendesk) do not block writes upstream at all. See Read-only guarantees.
Do my databases need to be on the internet? No — that is the point of the desktop split. They need to be reachable from the machine running Triagic. If you need a VPN to reach production, so does Triagic.
Is there a hosted version that runs the investigations? No. Tool calls are long-lived local processes talking to systems that are usually private. See Architecture.
Setup
What do I need before I can investigate anything? An AI provider and at least one integration. Playbooks are optional — unmatched tickets get generic triage.
In what order should I set things up? Integrations before playbooks, because the playbook's data-source picker can only offer integrations that exist. Full list: Admin setup checklist.
Why can I not add a second member? The trial is one seat. Buy seats on the Account page and the invite goes through — see Roles, plans and seats.
I changed something in the portal and the app has not noticed. Sync is a poll, roughly every 15 minutes, or immediate on a manual refresh. See the checklist.
Playbooks
How does a ticket get assigned to a playbook? An LLM classifier matches it against every enabled playbook's description and routing hints at ingest. Assigning one by hand pins it so the classifier will not override it.
Why did my new playbook not apply to existing tickets? Classification runs at ingest or on an explicit Re-investigate, never retroactively. Re-investigate the tickets you want re-routed.
What does an empty data-source list mean? All of them. Empty is "no restriction", not "no tools".
Does team scoping affect which playbook a ticket gets? No. Teams govern who can manually use a playbook. Auto-classification considers every enabled playbook in the organization.
Access and secrets
Can members see shared credentials? No. The member-facing view has no credential fields at all — not masked ones — and members cannot edit shared configurations, so they cannot repoint a credential either.
But can they read the data those credentials reach? Yes, through the agent. "Cannot view" means the secret's value, never the data it unlocks. Scope the credential itself.
How do I remove someone? Disable them on the Members page. It takes effect on their next authenticated call, frees the seat, and keeps their history attributed. See Members.
I lost the admin password. Password resets are done by another org admin from the member edit dialog. The account owner's own credentials are managed on the Account page.
Cost
Where do I see what this is costing? The desktop's Usage page. Spend telemetry never reaches the portal, which is why the portal can set a cap but not show a total. See History and usage.
What happens at the spend cap? Background triage defers and retries; Console and chat refuse cleanly before streaming; a run that crosses the cap mid-flight stops. See Spending.
How do I make investigations cheaper? Narrow playbook data sources, sharpen triage instructions, prune unused playbooks, and check the per-task split on Usage — classification runs on every ticket and is often a bigger share than expected.
Desktop
Which build do I need on macOS? Apple Silicon for M1 and later, Intel otherwise. Apple menu → About This Mac → Chip.
macOS or Windows says the developer is unverified. The build is unsigned. Verify the SHA256 against the download page first, then right-click → Open on macOS or More info → Run anyway on Windows. See Install.
Does it work offline? An open session does, and configuration stays as of the last sync. A new sign-in does not — credentials are verified against the cloud every time. Investigations do not either; they need your infrastructure and your LLM provider.
Why can I not edit playbooks in the app? Your install is centrally managed. Edit them in the portal; the local refusal exists so your edit is not silently lost on the next sync.