Explanation · the company trust boundary

The boundary is the product.

One installation gives a company a private place for small web software.

Privacy is ambient

There is no public mode or privacy checkbox. Every site inherits the organization’s Access identity boundary.

Content stays separate

Generated JavaScript runs on sibling site hostnames and receives no Worker bindings or secrets. Control mutations require exact-origin requests.

Deployment is atomic

Files remain pending in private R2 until every manifest digest is verified. Visitors never see a partial update.