Set up TigerMole Team
Configure the local metadata audit, ED25519 signing, managed labels and optional X25519 encryption.
1. What Team adds
The Team tier adds an ED25519-signed audit chain, JSON export and managed labels for each seat. The persistent audit contains detection metadata; it does not store the prompt, response or original secret.
Detection and masking run on the device. TigerMole processes content temporarily in memory and does not send it to its servers.
2. Activate the license
Use the same Team key on every machine. During activation, assign a managed label such as seat-042 or runner-ci-01.
The X25519 public key is optional. You can activate Team without one and import it later if the organization chooses to encrypt logs or exports intended for review.
tigermole-proxy activate "$TIGERMOLE_LICENSE_KEY"
tigermole-proxy import-audit-key /path/to/team.pub
3. Optional audit encryption
If you need this additional confidentiality layer, generate the pair once with the key tool. Distribute the public key (.pub) to machines and keep the private key in a vault or HSM.
You can also generate it on a secure machine:
tigermole-proxy keygen
4. Distribute and verify the optional key
Distribute the public key through your MDM or Ansible and import it on devices that should encrypt audit files. Installation and masking do not depend on this step.
tigermole-proxy verify-keys --pub team.pub
PASS confirms the expected key format. If you see a curve error, check that the key is X25519: ED25519 is used for signing and X25519 for encryption.
5. Review the audit
The persistent audit remains limited to metadata when X25519 encryption is enabled. Define who can access the files, apply the retention period approved by your organization and verify the local chain periodically.
Next step
Read the audit-key lifecycle and the audit contents and limitations.