[SELF-HOSTED ACCESS PLATFORM]

Access control
that starts
at the machine.

Employee directory, credential vault and device-bound logins — self-hosted on your server. Your team gets one-click access. You get full control and a complete audit trail.

1 : 1

AES-256

ENCRYPTED CREDENTIAL VAULT

DATA LEAVING YOUR SERVER

[PLATFORM]

Security first.
Everything else follows.

Device-bound Login

Resource Vault

Employees open CRMs and tools without ever seeing passwords. One-time 30-second tokens, AES-256-GCM at rest.

IP Access Policies

Control which networks each role can log in from — and which subnet each resource opens from. Blocked means a silent 403.

Dynamic Directory

Design your own employee fields, statuses and forms. Presets for call centers, retail and office — nothing hardcoded.

Granular Roles

RBAC with per-field visibility, per-user overrides and anti-escalation. Sensitive data stays hidden until explicitly granted.

Full Audit Trail

Every login, password reveal and resource launch recorded with actor, machine, IP and timestamp.

[HOW IT WORKS]

From license to first login
in four steps.

01 —

Get your license

We issue a key bound to your domain. Invoicing and renewal reminders are handled for you.

02 —

Deploy on your VPS

Run docker compose up. The Setup Wizard walks you through license, admin account and company config in minutes.

03 —

Bind your team

Employees sync the browser extension once. The first login binds their machine automatically — only IT can unbind it.

04 —

Stay in control

The portal checks in with the license server a few times a day. No employee data ever leaves your server — and expiry means read-only, never lockout.

[PRICING]

Start with Core.
Add what you need.

One base license, self-hosted, up to 100 employees. Security and operations modules are enabled per license — upgrade any time without redeploying.

CORE — ALWAYS ON

^€1,490

/ YEAR · UP TO 100 EMPLOYEES

Device-bound login + browser extension
Employee directory + field constructor
Roles & RBAC with per-field access
Resource Vault — included
Admin Panel
Full audit log
CSV import / export

VAULTINCLUDED

Resource Vault

One-time launch tokens, AES-256-GCM, passwords never reach the clipboard. Part of every Core license.

MOD_IP+€390/y

IP Firewall

Role × network login policies, per-resource subnet locks, remote-work overrides with expiry.

MOD_TABLES+€590/y

Custom Tables

Registries for any department — inventory, vendors, contracts — with the same constructor, RBAC and export.

MOD_HR+€290/y

HR Portal

Separate onboarding portal: form builder, pending employee cards, IT confirmation flow.

MOD_FLOOR+€290/y

Floor Plan

Live office seating map, re-seat queue with device unbinding, movement history.

MOD_DASH+€190/y

Dashboards

Per-role widget layouts: counters, activity feed, machine alerts, real-time notifications.

COMPLETE — CORE + ALL MODULES €2,790 / year · save €470

ENTERPRISE — UNLIMITED EMPLOYEES White-label branding · AD/GPO · SLA · deployment included

[OPTIONAL]

Deployment Support — €490 one-time

VPS setup, DNS configuration, Docker deployment, SSL, first super_admin onboarding. Available for any package. Recommended for teams without a dedicated DevOps engineer.

    self-hosted  ·  full feature access  ·  your data stays on your server
  

[SYSTEM REQUIREMENTS]

Runs on any server
with Docker installed.

Docker Compose is the only dependency. Works on any Linux, Windows Server, or bare metal — your client's infrastructure, your client's rules.

MINIMUM SERVER

2 vCPU · 2 GB RAM
20 GB SSD
Any Linux (Ubuntu 20+, Debian 11+, RHEL 8+)
Windows Server 2019+ with Docker Desktop
Bare metal — fully supported

REQUIRED SOFTWARE

Docker Engine 24+ or Docker Desktop
Docker Compose v2+
Domain + DNS access (for SSL)
Outbound HTTPS to license server (port 443)

DEPLOY IN 3 COMMANDS

$ cp .env.example .env
$ nano .env # fill your values
$ docker compose up -d

INCLUDED IN DOCKER IMAGE

Node.js 20 (app)
PostgreSQL 16 (data)
Redis 7 (sessions, rate limiting)
Nginx (reverse proxy + SSL via Certbot)

[NOTE] No Node.js, PostgreSQL, or Redis installation required on the host — everything runs inside Docker containers. The only thing your client needs is Docker.

[ARCHITECTURE]

Three independent layers.
Zero data mixing.

SERVER TOPOLOGY

license server (ours)
  license.vendor-domain
  → validation API only
  → never sees employee data

your VPS
  portal.yourcompany.com
  → IT Portal + PostgreSQL
  → all data stays local

other customers
  their own servers
  → fully isolated instances
  → zero shared infrastructure

LICENSE PING PAYLOAD

POST license.yourdomain.com/validate

{
  license_key: "XXXX-XXXX-XXXX",
  domain_hash: SHA256(domain)
}

← {
  valid: true,
  modules: ["vault","ip","tables"],
  employees_limit: 100,
  expires: "2027-06-01"
}

// no agent data transmitted

[ACCESS SECURITY]

Every login is bound
to a physical machine.

Employee directories are easy. Controlling who opens what, from which desk, on which network — that's the hard part. It's what this platform is built around.

01 — DEVICE BINDING

1 employee = 1 machine

The login code is generated on the bound device only. A stolen ID is useless from any other computer. IT unbinds — never the user.

02 — CREDENTIAL VAULT

Passwords employees never see

One-time 30-second tokens autofill CRM logins. Nothing in the clipboard, browser history, or plain traffic. AES-256-GCM at rest, key in env only.

03 — NETWORK CONTROL

Two-level IP policies

Roles log in from office networks only; each resource can be locked to its own subnet. Blocked means a generic 403 — no hints for outsiders.

AUDIT LOG — LIVE

14:02:11 login.ok #•••12 · WS-••7 · 10.0.•.••

14:02:38 vault.launch CRM-EU · token burned in 4s

14:03:05 ip.blocked role:agent · off-network 403

14:04:19 password.reveal by it_admin · auto-hide 60s

14:05:47 login.denied #•••81 · unbound device

14:06:02 device.bound #•••81 → WS-••3 · by IT

14:07:30 field.edit position · by it_admin · logged

EVERY ACTION · ACTOR · MACHINE · IP · TIMESTAMP

[GET IN TOUCH]

Get your license

Tell us about your company and the modules you need. We'll issue your license key and have you deployed the same day.

Access controlthat startsat the machine.

Security first.Everything else follows.

From license to first loginin four steps.

Start with Core.Add what you need.

Runs on any serverwith Docker installed.

Three independent layers.Zero data mixing.

Every login is boundto a physical machine.

Get your license

Everything you needto deploy and scale.

Access control
that starts
at the machine.

Security first.
Everything else follows.

From license to first login
in four steps.

Start with Core.
Add what you need.

Runs on any server
with Docker installed.

Three independent layers.
Zero data mixing.

Every login is bound
to a physical machine.

Everything you need
to deploy and scale.