Your model is yours. Your data stays isolated. You can always walk away.
Tenant isolation, least-privilege access, a forensic audit trail and no lock-in. This page is written for the person who signs the MSA.
EU-hosted. EU-operated. EU-owned.
Built by a Swedish company on EU infrastructure only — no US cloud providers, no US subprocessors, outside CLOUD Act reach. Your landscape maps your critical systems and what an outage costs; it never leaves EU jurisdiction.
The AI layer holds the same perimeter: bring your own LLM, your endpoint, your DPA.
Sovereignty covers hosting, operations, ownership and processing. The open-source stack (.NET, React) is of mixed origin; code origin does not move data across jurisdictions.
Full JSON export, any time. No exit fee.
Applications, components, dependencies, capabilities, datasets, processes and the rest export as open, line-delimited JSON (NDJSON), gzip-compressed on request. Import into another tenant, archive it, or take it elsewhere.
Users, passwords, grants and audit logs are platform state, not landscape data, and are not included.
Security posture
Tenant isolation
Every organisation in its own isolated tenant, built and tested for critical-infrastructure operators and government agencies.
Stewardship grants & RBAC
Portfolio, business-model and infrastructure edit grants plus a revenue-visibility axis, over per-team Viewer / Editor / Admin roles.
Append-only audit log
Forensic, queryable record of who did what. Stores only a short actor signature, so it is data-minimised and survives actor deletion.
Per-tenant SSO (OIDC)
Full id-token validation against your IdP, encrypted client secrets, token never in the URL, group claims re-evaluated on every login.
Encryption
All tenant data encrypted at rest. SSO secrets and OAuth state additionally sealed with AES-256-GCM and never returned to the client.
Passkeys & two-factor authentication
Passkeys (WebAuthn) or an authenticator app, with single-use recovery codes. An organisation can require a second factor of its members; for SSO tenants the identity provider keeps that job, and Dependra can insist its assertion proves it.
Support, stated honestly.
Prioritised support during office hours on higher tiers. No 24/7 hotline or uptime SLA in standard plans; Custom plans can include a contractual SLA.
Talk to sales →Reporting a vulnerability
Email security@dependra.com (also in /.well-known/security.txt). English or Swedish. Good-faith research is covered by safe harbour.
Evaluate the platform, exit rights and all.
Model a slice of your estate, export it as JSON, and confirm you can take it with you.