Built for organisations that keep their data in-house

On-premise and air-gapped

Every service, the databases and even the AI model run on your own server. The licence is a signed file that activates with no internet connection.

Identity and access

Secure sign-in and precise control over who can do what.

• Two-factor authentication (TOTP) with recovery codes
• LDAP/Active Directory sign-in with group-to-role mapping
• Single sign-on via OIDC and SAML 2.0 — with a different identity provider per organisation, for AD FS and for MSPs
• User provisioning with SCIM 2.0: joiners, leavers (which revokes their sessions immediately) and group membership
• Fine-grained roles and permissions, and personal API keys with a scope and a request budget

Audit and traceability

Every operation in every service is recorded and searchable by user, service, module, time range and IP. Audit exports are signed so they can be verified.

Multi-tenancy (MSP)

Each organisation or branch gets separate data, user and device quotas, its own administrator and its own branding — for holdings and managed-service providers.

High availability and recovery

A three-node kit with automatic database failover, nightly backups, one-command restore and a disaster-recovery drill checklist.

Secure by design

Passwords hashed with Argon2id, device credentials encrypted with AES-256-GCM, rate limiting, short-lived tokens and sensitive data encrypted at rest.

A version number, and an update check that stays quiet

The panel has an About page: the build it is running, the one it was upgraded from, and the release notes.

• The check runs when you press the button, never on a timer — a panel inside a hospital network must not contact anyone because a page was opened
• It runs server-side, so no browser of yours ever talks to an outside address
• Four clear answers: current, an update is available, ahead of the site, or unavailable with the reason
• Point the check at your own origin, or switch it off entirely — the page then says so rather than offering a button that quietly fails