Where it runs

Three shapes, and the choice is usually made for you by what your regulator or your works council thinks about employee-device evidence leaving the building.

Hosted

We run the backend and the console; you run the agent. The fastest path to a populated console, and the right answer for most organisations.

Your organisation is provisioned as its own tenant. Isolation is structural: the organisation a query runs against is derived from the authenticated caller on the server, every time, rather than taken from a request.

In your own estate

The same three components, deployed inside your environment: the agent on the machines, the backend and the console on infrastructure you control. Evidence about employee devices never leaves your boundary.

What this needs is written down rather than discovered — hosts, storage, TLS, the claims your identity provider must issue, and the secrets you have to hold before the first deploy. The reference architecture has three HTTPS origins, and the device origin and the console origin are deliberately not the same host.

With no egress at all

Air-gapped operation is supported, and it is not a degraded mode bolted on afterwards — it is why the installers are served from your own deployment rather than from a public host in the first place.

What it costs: installer distribution becomes your job, and the model rate table that prices tokens cannot refresh itself, so token cost is priced from whatever table was last loaded. Everything else — collection, ingest, grading, the console, evidence packs, the nightly export — behaves identically.

What changes for the reader, either way

Almost nothing. The agent is the same binary, the console is the same application, and the documentation does not hardcode a deployment URL in prose anywhere, because every customer's console is their own host.

The six pages behind this one — overview, reference architecture, requirements, the installation runbook, air-gapped operation, and backup and restore — are in the full documentation.