Your building

Runs inside your company.

Your identity, your storage, your network. Nothing about this needs to leave your infrastructure, including the parts that usually do.

Your IdP

Sign-in goes through the directory you already run. The connection is configured per organisation and the mapping from groups to roles is reapplied every time somebody logs in, so revoking access in the directory revokes it here.

OIDC — against Entra, Keycloak or Okta — one connection per organisation, with its own health check.
Reapplied at login — group-to-role mapping is not a one-off import that drifts; it is recomputed on every sign-in.
The issuer is dialled carefully — an org-supplied issuer URL is a URL a stranger chose, so by default it must resolve to a public address. An identity provider inside your network — and so single sign-on on an air-gapped install — works once the operator allows its address and saves the connection themselves, vouching for it. A certificate from your internal authority is accepted once the operator adds it, for single sign-on alone.
Deployment settings stay with the operator — the mailer, claiming an email domain for single sign-on, turning forced single sign-on on while domains can be claimed, vouching for an identity provider inside your network and letting an issue tracker or an AI endpoint dial into it all act on the whole deployment, so only the operator changes them: the install's platform admins and, if the operator names one, the admins of the organisation that runs it. The rest of a connection stays with the organisation's own admins.

Setting up single sign-on

Four roles, in a ladder

Roles are workspace-level and ordered, so a higher one covers everything the ones below it can do. There is no matrix of checkboxes to get wrong.

Owner, admin, member, viewer — in that order — every permission check asks whether your role is at least the one required.
Membership is per workspace — a member reaches only the workspaces they were added to; organisation owners and admins reach every one.
Seats are organisation-level — and a seat is a membership, whatever the role. A viewer you invite occupies one.
Reviewers on a link do not — a board is a URL: the tester who opens it, draws a region and types a sentence never becomes a member, so they never take a seat.

Your bucket

A single Go binary with SQLite inside it for metadata, and your own storage for the files. One compose file, one volume, and the schema migrates itself at boot.

Any S3 store — Hetzner, MinIO, AWS — or plain local disk. A read-through NVMe cache sits in front of the S3 backend and is skipped entirely for local disk, which is already local.
You hold the keys — nothing leaves your storage unless you decide it does.
One binary — SQLite is inside it, so the metadata store is not another thing to operate, back up and page someone about.
A warm standby — a second host can wait as a standby behind a write fence, and a host the fence does not name refuses to start as the writer — two writers are impossible by construction.

Your keys

Every workspace has its own data key, wrapped by a key-encryption key you hold — in the environment, or in an OpenBao or Vault transit engine on a separate box — and every time a workspace key is opened, the audit trail says so.

Rotate and shred — the key-encryption key rotates by re-wrapping the workspace keys, never by re-encrypting data. Shredding a workspace destroys its key, so its files, its caches and every backup taken afterwards are unreadable.
Re-checked while it runs — every open workspace's key is unwrapped again on a schedule, so a revoked or rotated key stops serving within minutes rather than at the next restart.
Sealed backups — a backup archive is sealed under your key-encryption key and restores only into an empty directory, never over a live one.
Scanned and redacted — with a clamd daemon configured, every upload is scanned before it is stored and refused if the scan fails. Recordings are masked by the recorder and again by the server, and deleted sessions are purged after a grace window you set.

Encryption, in the docs

Air-gapped

One environment variable is the master kill switch for every call the product would otherwise make to the public internet. It is a switch rather than a promise, so the list of what it cuts is short enough to read.

AIR_GAP=1 — blanks every integration that reaches the public internet: the email provider, Telegram, GitHub (app, token and sign-in), the Eve AI channel and managed AI, Plane, Stripe, web push, the Have I Been Pwned check, link previews, Sentry and trace export. Sign-in stays inside too: single sign-on reaches only an identity provider on your network, and AI clients register without a metadata document fetched from outside.
Your own endpoints stay yours — S3, SMTP, the capture sidecar and meeting transcription are your own services, so they keep working, and meeting audio never leaves your network. Issue connectors such as an internal Jira, and an AI backend or model endpoint on your network, are confined to internal addresses rather than switched off, and work once the operator has saved them.
Nothing to explain to the firewall — the point of the switch is an audited log with no unexplained egress in it.

Air-gapped installs, in the docs

The licence is a file

Entitlement is a signed file on disk, not a call home. There is no licence server to be unreachable at three in the morning.

Signed, not phoned — an Ed25519 signature over the payload — customer, tier, seats, entitlements, issue and expiry dates, and whether the install is air-gapped — checked on your host against the vendor key built into every release.
Absent means unrestricted — no file is not a locked product. A file that is present but does not verify fails the boot loudly instead of quietly degrading.
Fourteen days of grace — past expiry the deployment keeps working behind a banner for fourteen days; after that it pauses writes until a renewed file is installed, while reading and signing in keep working.

What gets recorded

The events an auditor asks about are written as they happen, with the actor and the thing acted on.

Access — sign-ins and refused sign-ins, break-glass use, members invited, joining, removed and changing role, passkeys and passwords changed, sessions revoked.
Credentials and keys — API and agent tokens minted and revoked, connected apps granted and revoked, share links created and revoked, workspace keys unwrapped, shredded or revived.
Structure — workspaces created, suspended and reconfigured; plan, single sign-on and email settings changed.
Tamper-evident export — a self-hosted install can export the log as hash-chained, signed batches to a write-once directory or an Object Lock bucket that the data host cannot rewrite.