Data on your infrastructureDocuments, the search index and the database live on the machine your company operates. Indexing, OCR and search run locally; a thousand questions cost nothing and leave nothing behind in a vendor cloud.
Remote access, when you want itIt is off until you switch it on. While it is on it runs through an encrypted tunnel, sign-in is always required, and the workspace tells you if the edge allow-list is not yet in place. Failed sign-ins are rate-limited and reported to the owner.
Two-factor where it countsAn administrator can install updates, so on a shared workspace — a company licence, a network address or remote access — a password alone is never accepted: administrators enrol an authenticator app before their first session — on a server that listens on the network, the first one right at setup. On one computer nobody is asked: whoever reaches the sign-in page is already at the keyboard. The same can be required of everyone, and is asked of everyone by default while remote access is on. Passwords are twelve characters or more, and common ones are refused; a forgotten password is recovered on the machine itself, never through a server of ours.
Roles that fence, server-sideOwner, admin, engineer, viewer, client, management. A client sign-in reaches one read-only portal route and nothing else — enforced in the API, not hidden in the interface. What the company switches off in the portal is never even sent, and an address typed by hand reveals nothing a role may not have.
Walked, not assumedThe boundary is not a claim on a page: before each release the whole product is walked twice, once as an ordinary engineer and once as an administrator who is not the owner, watching every request the browser makes. Anything a role should not see and still receives is a defect, and is fixed before the release ships.
The operator's own machine stays theirsMail, calendar and notes read from the computer the workspace runs on belong to the person who owns that workspace — not to the administrator role. A customer's IT administrator can run their whole company in it and never reach them, unless the owner deliberately widens that.
Per-user encrypted secretsMail sign-ins and AI keys are stored encrypted per person. No user, and no API, can read another's mailbox or key.
Signed updates onlyUpdate packages must carry a valid signature from the seller's key to install. A tampered package refuses itself.
Licences without a data pathInstalled copies validate a signed licence file locally and renew it with a small daily check-in that carries version, machine code and document counts — never content. If the licence service is unreachable the app keeps working through a generous grace window, and an expired licence turns the workspace read-only; nothing is ever disabled or deleted remotely. A site tool must never brick mid-project.
Backups, two layersScheduled local backups of the record, plus an encrypted nightly backup of the application record to storage the operator chooses. Restores are part of the design, not an afterthought.
An audit trail that remembersLogins, changes, approvals, substitutions, escalations and deletions — who did what, permanently on the record.
Trials cannot touch youTrial and demo accounts are pinned to a demo project. Live projects do not exist for them.