GDPR by design
Data minimization, workspace-level isolation, full audit trail, and export/erasure-friendly data model. A DPA is available on Starter and above.
Trust
Security, hosting, and what we do not claim
The answers a security review asks for, in one place: how a deployment is shaped, where the data sits, what the platform does to protect it — and the claims we will not make. Nothing on this page is aspirational. Start with the pack, or talk to us.
Trust without theatre
What is Live — and what we will not invent
Enterprise leads deserve residual honesty next to real product evidence. No borrowed logos, no fake certifications, no multi-region mesh we do not operate.
Live
Product trust you can verify
These capabilities ship today. Measure them in a trial or walkthrough — not a brochure claim.
Deterministic step budget
Executions are bounded by steps, not a wall-clock timer. Same input, same verdict under load and on regulatory replay years later.
Residency options you control
Hosted EU regions (Frankfurt default), your AWS/Azure/GCP account (Business), or on-prem / air-gapped Kubernetes (Custom).
Free trial — no card
Email and password only. The trial does not auto-convert. Export anytime. Full authoring, runtime, and VS Code extension.
Residual
Claims we refuse to make
Stated here so a security review or technical bake-off never has to discover them three months later.
No SOC 2 / ISO / HIPAA certification today
Operational practices are SOC 2-aligned; alignment is not certification. We will not display badges we do not hold. Formal certification is on the roadmap.
No multi-region hosted mesh
Hosted trial and Starter stay in EU regions. We do not list us-east-1 or a global SaaS mesh as ours. Business/Custom run the same images in your cloud or on-prem.
Not a Rete / working-memory engine
DecisionManager is a single-pass decision runtime with compiled indexes and a step budget — not Rete/Phreak forward-chaining with agenda re-activation. Residual multi-algo is not marketed as Live.
Evaluate with confidence
Start a free trial on your own rules, or book a 30-minute executive demo with someone who has migrated regulated policies.
No credit card · Trial does not auto-convert · No fake logos or certifications
Compliance & hosting
You stay in control of decision data
Security buyers care less about slogans than about who can change a rule, where the data sits, and what evidence an auditor can see. DecisionManager is built so those answers are yours — hosted EU, your cloud, or air-gapped — not ours to invent later.
EU data residency
Hosted plans run in EU regions (Frankfurt by default). Your rule definitions, executions, and warehouse data never leave the region you choose.
On-prem & sovereign cloud
Custom runs entirely on your infrastructure — your cloud account, your datacenter, or an air-gapped environment. Same images, same features.
Security practices
Argon2id password hashing, short-lived JWTs, hashed API keys, and least-privilege RBAC. We follow SOC 2-aligned operational practices; formal certification is on our roadmap — we won't claim otherwise.
Controls you can exercise
These are product controls, not marketing badges. Each one maps to a question a security review actually asks.
Where data lives
Choose hosted EU, your own AWS/Azure/GCP region, or on-prem/air-gapped Custom. The deployment matrix below is the full list.
Who can publish
Least-privilege RBAC and a draft → review → approved → published path so authoring, approval and administration stay separable duties.
Evidence for auditors
Workspace isolation, a full audit trail of platform activity, and an export/erasure-friendly data model. DPA on Starter and above.
Execution boundary
A hash-verified edge bundle can run with no database and no outbound network — decisions inside a perimeter the control plane never crosses.
Where your data can live
Three hosting shapes, the same images and the same features. Pick the row your regulator will accept.
| Deployment | Data location | Operated by | Available on |
|---|---|---|---|
| Hosted (EU) | EU regions, Frankfurt by default | DecisionManager | All plans |
| Your own cloud account | Any region you choose | You, on your infrastructure | Business and Custom |
| On-premise / air-gapped | Your datacenter | You, with no outbound network required | Custom |
A decision bundle adds a fourth shape: the hash-verified .dmb artifact runs with no database and no outbound network at all, so the decision itself can execute inside a boundary that the control plane never crosses.
What we do not claim
Procurement questions we would rather answer here than in a security review three months from now.
- No certifications
- We hold no SOC 2, ISO 27001 or equivalent certification today. Our operational practices are aligned to SOC 2 controls; alignment is not certification and we will not present it as one.
- No automated ODM migration
- AI-assisted translation of ODM rulesets is real and it removes most of the typing, but every migrated artifact is reviewed and approved by a person before it is published. We do not promise a one-click migration.
- No uptime guarantee without an SLA
- The hosted service is provided as-is unless your plan includes a written SLA. Custom plans do; the self-serve plans do not, and we would rather say so on the pricing page than in a footnote.
- No customer logos on this page
- We will not put a name or a testimonial on this site without written permission from the customer. An empty logo wall is more honest than a borrowed one.
For the security questionnaire
Download the attachable brief, send the gaps to us, or run a decision in the browser first. No fake badges required to start.
Pack is a plain Markdown brief (hosting matrix, controls, non-claims). DPA and written SLA are available on the plans that include them — ask on the contact form.
Easy next steps
Three paths security and procurement teams actually use. No signup wall on the pack or the demo.
- Download the security packHosting matrix, product controls, and non-claims in one Markdown file you can attach to a ticket.
- Contact sales / securityQuestionnaire, DPA, Enterprise SLA, or an awkward gap this page left open — we reply within one business day.
- Run a live demoExecute a sample decision in the browser before you book anyone's time.