Your perimeter
Deploy inside your network. Keep source, application data and model traffic under your control.
Security
Security is a deployment property, not a slide.
PhiWebs Code is built for organizations that need to explain how AI changes are made, reviewed and released. The controls live in the workflow itself, where reviewers and auditors can see them.
Principles
What the design optimizes for.
Least privilege
Connect your identity provider and grant access through roles, not shared credentials.
Review before release
A human approval gate sits between an AI change and the environment that serves users.
Evidence by default
Every release keeps the change and approval record available for audit and investigation.
Data boundary
The AI does not get its own exit door.
Model access is part of your deployment design. Use your own provider, your own gateway and the network controls your security team already operates.
01
Self-hosted deployment Run the platform on infrastructure your organization owns and monitors.
02
Bring your own model access Use an approved provider or an internal gateway. No shared public key required.
03
Air-gapped operation Install and activate without an outbound connection when the environment requires it.
Controls
Controls your team can explain.
The goal is a workflow where the important answers already exist when someone asks for them.
Identity and access
Use your existing identity provider, role model and joiner/leaver process.
SSO / OIDC Role-based access Session control
Change control
Keep policy checks, approvals and the final diff attached to the release.
Policy checks Approval gate Release evidence
Secrets and data
Separate application secrets from the code and keep them inside your environment.
Secret isolation Data residency Local storage
Audit and operations
Export the record, inspect the logs and keep release history available.
Audit export Operational logs Retention controls
Honest boundaries
Ask for the current security pack.
We would rather answer specific questions than imply certifications we do not hold. For an evaluation, ask us for the current security overview, deployment notes and data-processing terms.
Your team should be able to test the deployment model, identity flow and audit export before a production rollout.
Next step