Your building

Runs inside your company.

Your identity, your storage, your network. Nothing about this needs to leave your infrastructure, including the parts that usually do.

Your IdP

Sign-in goes through the directory you already run. The connection is configured per organisation and the mapping from groups to roles is reapplied every time somebody logs in, so revoking access in the directory revokes it here.

OIDC — against Entra, Keycloak or Okta — one connection per organisation, with its own health check.
Reapplied at login — group-to-role mapping is not a one-off import that drifts; it is recomputed on every sign-in.
The issuer is dialled carefully — an org-supplied issuer URL is a URL a stranger chose, so it is refused unless it resolves to a public address — the same table that lets an air-gapped install reach its own internal Jira, read in the opposite direction.

Four roles, in a ladder

Roles are workspace-level and ordered, so a higher one covers everything the ones below it can do. There is no matrix of checkboxes to get wrong.

Owner, admin, member, viewer — in that order — every permission check asks whether your role is at least the one required.
Seats are organisation-level — and a seat is a membership, whatever the role. A viewer you invite occupies one.
Reviewers on a link do not — a board is a URL: the tester who opens it, draws a region and types a sentence never becomes a member, so they never take a seat.

Your bucket

A single Go binary with SQLite inside it for metadata, and your own storage for the files. One compose file, one volume, and the schema migrates itself at boot.

Any S3 store — Hetzner, MinIO, AWS — or plain local disk. A read-through NVMe cache sits in front of the S3 backend and is skipped entirely for local disk, which is already local.
You hold the keys — nothing leaves your storage unless you decide it does.
One binary — SQLite is inside it, so the metadata store is not another thing to operate, back up and page someone about.

Air-gapped

One environment variable is the master kill switch for every call the product would otherwise make to the public internet. It is a switch rather than a promise, so the list of what it cuts is short enough to read.

AIR_GAP=1 — turns off breach-checking against Have I Been Pwned, outbound email, Telegram, api.github.com, and the agent and issue-tracker integrations.
Your own endpoints stay yours — S3 and capture are internal services, so they keep working — an air-gapped install may reach its own network and nothing beyond it.
Nothing to explain to the firewall — the point of the switch is an audited log with no unexplained egress in it.

The licence is a file

Entitlement is a signed file on disk, not a call home. There is no licence server to be unreachable at three in the morning.

Signed, not phoned — an Ed25519 signature over the payload — customer, tier, seats, entitlements, issue and expiry dates, and whether the install is air-gapped.
Absent means unrestricted — no file is not a locked product. A file that is present but does not verify fails the boot loudly instead of quietly degrading.
Fourteen days of grace — past expiry the deployment keeps working behind a banner before any write restriction applies.

What gets recorded

The events an auditor asks about are written as they happen, with the actor and the thing acted on.

Access — sign-ins, members joining, and members being removed.
Credentials — API tokens minted and revoked.
Structure — workspaces created and suspended, plan changes, and test sends of the org's email settings.