The code
your GitHub
Yours from the first line, in your own repository — not handed over at the end as a favor.
fire us tomorrow, the app keeps running
Security
Right now, dozens of companies
have a copy of your business.
Your customer list. Your salaries. Your contracts. Every one sitting in a database belonging to somebody you have never met, protected by a security team you did not hire and cannot inspect.
It’s time to take back control.
The machines
your servers
Register a cluster of your own and everything deploys there instead of here.
invite-only todaythe data never leaves your building
The files
your storage
Your bucket, your region, your encryption key — switched on only once a real test round-trip succeeds.
documents sit where your lawyers said they must
The sign-in
your directory
People arrive and leave through the staff directory you already run.
someone leaves at 4pm, out everywhere at 4pm
The AI
your account
Ours, your own account with OpenAI or Anthropic, or a model running on a machine you own.
a vendor you can replace cannot set your terms
All of it.
The guard
Recorded always.
Stopped when you say so.
Most leaks are not break-ins. They are a well-meaning person putting the wrong thing in the wrong place on a Tuesday afternoon. A rule in a handbook does not stop that.
So we split the two: the record is always on and you never had to ask for it. The blocking is a decision about your own business, so it waits for you to make it — and it turns itself on the moment you tell us you handle regulated data.
The writing down is not optionalEvery call is recorded, from day one, with no setting to find and nothing to switch on. That part is not a feature you buy — it is how the thing is built.
The stopping is yours to switch onDeciding what may go where is a decision only you can make, so we do not make it for you. Until you do, you get the full record and nothing is blocked — and the page in your admin says exactly that, rather than implying a guard who is not there.
Unless you have told us you handle regulated dataSay you work with health or student records and it switches itself on, closed by default. A boundary that fails open on precisely the people it exists to protect is not a boundary.
A refusal is written down tooYou can see what was stopped, not just what went. That is usually the more interesting list, and it is the one nobody else can show you.
The book at the door
Everything that leaves
gets written down.
Not only the AI. Every email your software sends, every text message, every payment, every file that goes to another company. What went out, who received it, when — and what was taken out of it first, once you have said what should be. From the day you started to the app still running a year later.
Why that matters: one day somebody will ask what left your company and where it went. A customer, a regulator, your own board, or a lawyer after somebody else was breached. You answer with a list, not a shrug — and the list is the form they already use, with no limit on how far back it goes.
Part 05, in detail
The AI is a part.
Parts can be changed.
The last few years added one more company to everybody’s list, and most places have no say over which one it is. Here you do. Use ours. Use your own account with OpenAI or Anthropic, so the questions go under your contract and your bill. Or point it at a model running on a machine in your own building, in which case nothing leaves at all. We do not sell you the AI, so we have no reason to care which one you use.
Why that matters: a vendor you cannot replace is a vendor who sets your terms. If a price triples, a model gets worse, or a company you would rather not deal with buys one — you change that one part in an afternoon and nothing else moves. The app does not notice. You are not tied to anybody, including us.
And it stops you making a mess.Change the one that files your documents and it checks, first, whether your old files will still be findable. If they will not, it says so and refuses — “that one writes 3,072 numbers per item; your saved documents use 1,536, so it cannot be swapped in without rebuilding the index.” Plain words, before anything breaks, not after.
The power of one
Everything in one place
is your singularity.
Your work does not arrive all at once, and it does not have to move all at once. Each contract ends on its own date — no big-bang cutover — and what that company was doing for you becomes an app you own. The few you genuinely cannot replace, like your bank, stay where they are and connect in.
Year2026
Others holding your data120
Apps you own0
An illustration. The number is the picture’s, not a customer’s — every company’s list is a different length, and nobody has counted yours.
And then it can answer questions it never could.
A company has never been able to hold itself in its own head. What it knows lives in people — and people leave, forget, take holidays, and work in a different building from each other.
This is the return on one boundary: not only that less of your business sits in other people’s databases, but that for the first time all of it is somewhere a question can actually reach.
Somebody asks
“The Riverside order is late again. What do we do about it?”
What we are owed when they are late — clause 11.4
The customer already called twice about it
We paid this supplier early, in full, in June
They slipped the same way before — we used Harlow instead
usually lostThe old wayThree people, four days
and the 2023 note is gone, because the buyer who wrote it left in April.
Inside one boundaryOne question, four facts, one answer
Claim under 11.4, call the customer before they call a third time, and get a quote from Harlow — who we already know delivers when these people do not.
Your data answers questions it never couldNot a search box across four systems. One question, asked of everything the company knows, answered with the four facts that actually matter — including the one written down three years ago by somebody who has since left.
Agents get a whole company, not one appAn assistant bolted onto a helpdesk can only ever see helpdesk tickets. Inside one boundary it can read the contract, check the payment, find the old note and draft the letter — because all four are on the same side of the wall.
Every app you add makes the others betterThe forty-first tool is another island. The forty-first app here joins the same memory, so the thing you build in March is smarter in June because of what you built in May.
one company, one memory
Who decides
Software does not appear
inside your company by itself.
Three moments where a person, not a machine, has to agree. You choose which of them apply to you — a company of four can switch them all off, and a hospital can switch them all on.
BeforeSomebody says yes before a day is spentYour company writes the question it wants asked — why now, what does it cost us today — and routes it to whoever decides. If they say no, nothing was built and nobody spent a week describing it first.
DuringIt is checked, and what it finds goes backSecurity holes, the rules you told us you have to follow, and whether it does what you asked. Anything found is sent back to be fixed rather than waved through.
Before it is realGoing live is a person’s decisionEvery time. Not a setting somebody flipped last year — a named person, on the day, on the record.
Straight with you
What we cannot do.
Names, card numbers and addresses come out of a question before it leaves. Your judgment does not. If you ask a model about a problem, the model sees the problem — that is what asking is, and anyone who tells you otherwise is selling you something.
What you actually get to control is who sees it, whether they keep it, and whether you can prove either. That is the whole of what we sell. We are not going to pretend it is more.
The test of all of it
You can leave.
Take the code — it is already in your own repository. Take the data — it is ordinary Postgres, export it and walk. Take the files — they can be in your own storage from day one. Run the whole thing on your own servers. Use your own AI account.
Every company selling you independence would like you to depend on them instead. Ours is the shorter list: the things you would have to take with you are already yours.