core platform
Secure AI Appliance & Licensing
Turned the context-layer platform into a licensed, encrypted, self-installing appliance that runs inside the client's own cloud — no client data ever leaves their tenant.
- Client
- Core platform
- Role
- Architect & Owner
- Year
- 2026
Docker · Nuitka · PostgreSQL · AWS · Azure · Entra SSO · Caddy
Problem
Enterprise clients refused hosted SaaS — their data could not cross the public internet — but shipping the product into their clouds put the IP and the licence terms at risk.
Approach
- 01Packaged the platform and its agent as single-tenant VMs (Docker, Postgres 16, SSO, HTTPS-only egress) with a guided installer and a `doctor` diagnostic.
- 02Built a control plane: enrollment tokens, leases, appliance heartbeat, machine-bound activation, two-person kill and release attestation.
- 03Compiled and encrypted backend images with Nuitka and shipped them through a private registry with per-client pull scopes.
- 04Wrote the deployment canon — reference infra, security & governance, client deployment guide, MCP reference, BOMs — and ran the AWS and Azure rollouts.
Impact
0client-data egress
AWS+Azureclient-cloud installs
1-cmdguided install
- Deployed inside client clouds at Nokia, Vodafone Idea, AM/NS India and Multiples Equity.
- Zero client-data egress: the client owns infra and IAM; we ship images and docs.
- Started with a contract clause, hardened into full licensing once the deal sizes justified it.