One business.
One sealed instance.
An instance is everything your business runs on, built only for you: the workspace your team plans and logs time in, the assistant built into it, the gate that checks every internal call, your data and an auditor. Here is what is inside and how a question moves through it.
Six parts, none shared with another customer.
Projects, tasks and timesheets
Built on open-source Leantime: boards, handoffs, milestones, timesheets, documents, files and calendar, with owner and staff roles.
One assistant for everyone
Answers from your records with the sources attached, sees only what the person asking can see, and keeps each person's history separate. It reads and drafts; it never sends.
Identity gate
Every internal call carries a ticket that is valid once, for 60 seconds, for one caller and one route. The gate records who asked, what for, and the decision.
Your data
Each internal service writes only its own records, enforced by the operating system. What you author is versioned and backed up before every release.
Guardian auditor
A read-only auditor inside your instance watches logs and changes. It can raise an alarm. It can't change anything.
Separate services
Every service runs in its own container, as its own non-root user, on a network no other customer shares.
Your instance reaches only two things beyond itself: private AI models over a sealed link that admits nothing else, and our release line, which delivers updates only after they're approved. It has no route to any other customer.
"Is anything overdue?" takes seven checks to answer.
The sequence is the product. Each step either passes, or stops and tells you why.
A signed-in person asks
The dashboard knows who you are. Your question is filed under your own identity, never shared with a colleague's.
It uses your permissions
The workspace is read with the asker's own permissions. An employee never reaches another person's work; the owner sees the whole business.
The call gets a ticket
The gate issues a single-use, 60-second ticket naming the caller and the route.
The ticket is checked
No valid ticket, no answer. Every decision is written to the gate's log.
The records are read, never written
Through read-only tools, returning evidence, not prose.
The assistant drafts once, then checks the draft
Every figure, date and "you told me" must rest on the evidence or your own saved words. Claims of actions it didn't take are refused.
You get one of four outcomes
Grounded, couldn't answer, couldn't look, or held back. Never an unchecked guess.
Nothing goes live by accident.
Your instance runs from a pinned release. A change merged in our code does nothing to you until a release is approved and moved.
Built on a throwaway copy
Written and tested on an instance that is created per change and then destroyed.
Accepted on a standing copy
Proven end to end on a test instance with realistic data before anyone approves it.
Your data is snapshotted
Before every release, and re-checked after, byte for byte.
Moved to your pinned copy
Only with a named approval. A release can't write your data.
Checked live
Every agent's health and the gate itself are checked after the move. A failed check says so.
Web dashboard
Your workspace, the assistant, documents and your own conversation history, searchable by date or word.
Telegram at launch
Your business's own assistant number. Every person you invite talks to it from their phone, with their own private history.
Owner controls
Invite staff, set roles, choose whether employees can use the assistant, and see that every service is healthy.