Private retrieval plane
Indexes private source, serves private evidence, enforces local policy, and keeps credentials, raw queries, and repository paths in customer-controlled infrastructure.
Private deployments
Private context without private source leaving your boundary.
Enterprise is a planned private-deployment path for teams that need ContextAtlas against private repositories, regulated source, or procurement-controlled infrastructure.
Customer-network boundary
The hosted service does not become your private source vault.
Private snippets, prompts, repository paths, and indexes stay inside the customer-controlled deployment boundary. Hosted ContextAtlas remains the public-catalog service unless a customer explicitly enables a narrow bridge.
License heartbeat
Billing, license status, update channel, and optional redacted health. Heartbeat payloads must avoid sending private source content, prompts, or repo paths.
Public catalog only
Self-serve Free and Pro stay focused on reviewed public catalog packs. Enterprise private repository evidence remains local unless the customer enables non-private public-catalog bridging.
Deployment shapes
Designed around customer control first.
Planned deployment shapes include workspace-local, VPC, and customer-network deployments with explicit operator runbooks, signed releases, upgrade paths, and rollback procedures.
01
Workspace-local appliance
For teams that want the simplest private boundary near developer tooling.02
Customer VPC
For organizations that need network controls, private subnets, managed ingress, and internal observability.03
Restricted network package
For high-security environments that need limited egress, manual updates, or air-gap-adjacent operation.04
Dedicated hosted private tenant
Deferred until a future product explicitly supports hosted private source custody and the legal/security model is ready.Runtime options
Local by default. Bridge only by approval.
Local public-catalog mode
The deployment pulls signed public catalog revisions and serves both public and private evidence locally. This is the cleanest fit when hosted egress is not appropriate.
- Public catalog revision verification.
- Private source indexing and refresh.
- Local cache, retention, and restore runbooks.
Optional hybrid bridge
Hybrid mode may call hosted public catalog routes while private repository evidence remains local. The bridge must not reveal private repository intent through request metadata.
- Customer-controlled enablement.
- Non-private public-catalog requests only.
- Explicit audit trail for boundary decisions.
Roadmap capabilities
The pieces buyers will expect, staged honestly.
Enterprise readiness is a product, operations, and security program. It comes after the hosted public catalog service has real operational evidence.
Access and governance
- SSO/SAML/OIDC for identity providers.
- RBAC for owners, admins, developers, and auditors.
- Audit logs for admin actions, key custody, policy changes, and source-refresh events.
Source and retrieval
- private source indexing with explicit include/exclude controls.
- Secret scanning and redaction for ingested private source content.
- Bounded context packs that cite evidence without treating source text as instructions.
Operations and compliance
- Customer-managed keys where required.
- Custom retention and deletion controls.
- Deployment health dashboard, upgrade channel, backup, restore, and rollback path.
Security packet roadmap
Procurement material should match the real system.
Planned review packets include architecture notes, data-flow diagrams, deployment runbooks, retention controls, vulnerability intake, subprocessor posture, restore testing, and incident-response expectations. This page does not claim completed certification.
Architecture boundary memo
Data-flow and egress inventory
Operator runbooks
Retention and deletion controls
Upgrade and rollback path
Security review evidence
Pilot interest
Tell us what private boundary you need.
Use the contact route and choose Enterprise. This page is not a self-serve purchase or availability claim; it is the direction for private-deployment conversations after the hosted service has a stable operating baseline.