THE DATABASE ENFORCES IT, NOT THE APPLICATION
Most multi-tenant platforms filter by tenant in application code. One missed clause exposes another operator's fleet. We put the boundary somewhere a missed clause cannot reach.
Tenant Scope Lives In The Database
Every tenant-scoped table carries a row-level security policy, forced so that it applies even to the table owner. The tenant scope travels in the signed session token and is installed into the database transaction itself. A query that reaches outside its scope returns no rows, rather than returning someone else's data.
THE SAME BOUNDARY, TWO DELIVERY MODELS
Managed Service
Isolated tenancy
- Your organisation is a tenant of the platform, and the boundary between tenants is the database policy, not application logic.
- Inside your tenancy, your own partners and customers are segmented by that same mechanism.
- Primary data, backups, and object storage stay in Google Cloud in Sydney.
- Nothing for your team to host, patch, or monitor.
On-Premises Appliance
No shared tenancy at all
- One deployment serves one organisation. There is no other tenant on the system to be isolated from.
- Runs inside your infrastructure. We store none of your operational data.
- We hold no standing access. Support access is break-glass, granted and time-boxed by you.
- Your partners and customers remain segmented inside it by the same database-enforced boundary.
BUILT FOR NETWORKS THAT DO NOT TRUST THE INTERNET
Sovereignty, segmentation, and air-gap requirements are the reason the appliance exists.
The appliance is designed for restricted egress. The only outbound connection intrinsic to the product is HTTPS to the Starlink API. Everything else, including certificates, email, and log shipping, can be internalised or disabled, so the platform deploys inside segmented and protected networks.
Installation and upgrades can run fully offline. Release images are side-loaded, with no container-registry egress required, which is what makes a genuinely air-gapped deployment possible rather than merely firewalled.
You control the keys. At-rest encryption uses your own disk keys, and secrets resolve from your own vault or secret manager. No default accounts ship: every credential is generated at install, and the first administrator is created interactively.
More on the on-premises appliance.
WHERE THE PROGRAM ACTUALLY STANDS
Certifications
We do not hold an ISO/IEC 27001 certificate or a SOC 2 report today. We run an ISO/IEC 27001 and SOC 2 program, and we will not describe ourselves as certified until a certification body says so.
Ask us where the program stands and we will tell you, with the evidence pack, under NDA. If your procurement requires a formal accreditation such as iRAP, that can be scoped and delivered under a statement of work.
Running a vendor assessment? The evidence pack covers the control detail, the current program status, the software bill of materials, and the architecture material that does not belong on a public page. It is shared under NDA.
This page summarises our isolation and deployment model for evaluation purposes. Contractual commitments are set out in the services and support agreement. Starlink is a trademark of Space Exploration Technologies Corp. Starfleet Hub is not affiliated with or endorsed by SpaceX.
