Tenant isolated
State, credentials, and releases stay scoped to one org boundary. No shared blast radius.
Org-scopedBuild, release, monitor, and audit Swiss-hosted apps without losing the trail.
Source, build, deploy, monitor, audit, and recovery are a single chain of receipts, not six disconnected dashboards.
Every promise maps to a concrete control an operator can inspect.
State, credentials, and releases stay scoped to one org boundary. No shared blast radius.
Org-scopedVariables are stored for deploys and never echoed back. Key names only, sealed values.
AES-GCMRollback and restore are first-class workflows, not afterthoughts. Drills stay visible.
Daily drillsRuntime, storage, and backups live in Zurich. Sovereignty is a host choice, not a slogan.
Zurich, CHYou deploy in the console. Operators run incident and recovery from a separate plane. The line between them is sealed by design — neither side reaches across.
Google sign-in. Customer workflow. The operator panel stays on its own surface.