The Chart
A record that keeps its own history
Every client gets their own vault, kept in plain files any program can read.
Every change is attributed and reversible.
Your data format is your export format. No lock-in, ever.
The Gate
One door, watched
Public services are reached through an entry point that dials outward only —
nothing on the internet can open a connection inward.
The building has no inbound doors to force.
The Board
One live picture
Every system, its health, and what is talking to what — one screen, in plain
language.
If it moves on the board, it is really moving.
The Ledger
Nothing happens unrecorded
Assistants propose, a person approves, and the record is written before the
action runs — not after.
Proposed → approved → written down → done. In that order.
The Vault
Backups that survive the building
Encrypted on your machines before a byte leaves them, copied off-site nightly,
keys held by you alone — and restore-drilled from the off-site copy, because
that is the one a fire leaves you.
An untested backup is a rumour. Ours restore on a schedule.
The Perimeter
Outbound traffic is a decision
By default, systems here cannot reach the internet at all. Anything phoning out
needs an explicit entry on a short list you control.
The default answer to "may I phone home?" is no.