Data on your infrastructureDocuments, the search index and the database live on the machine your company operates. Indexing, OCR and search run locally; a thousand questions cost nothing and leave nothing behind in a vendor cloud.
One encrypted doorRemote access passes through an encrypted tunnel with an edge allow-list; there is no anonymous surface. Sign-in is always required, and failed logins are rate-limited and alerted.
Two-factor for administratorsAdmin sessions can install updates, so a password alone is not accepted: administrators must enrol an authenticator app before their first session.
Roles that fence, server-sideAdmin, engineer, viewer, client, management. A client sign-in reaches one read-only portal route and nothing else — enforced in the API, not hidden in the interface. What the company switches off in the portal is never even sent.
Per-user encrypted secretsMail sign-ins and AI keys are stored encrypted per person. No user, and no API, can read another's mailbox or key.
Signed updates onlyUpdate packages must carry a valid signature from the seller's key to install. A tampered package refuses itself.
Backups, two layersScheduled local backups of the record, plus an encrypted nightly backup of the application record to storage the operator chooses. Restores are part of the design, not an afterthought.
An audit trail that remembersLogins, changes, approvals, substitutions, escalations and deletions — who did what, permanently on the record.
Trials cannot touch youTrial and demo accounts are pinned to a demo project. Live projects do not exist for them.