A shared identity
Tael Identity manages sign-in, sessions, and membership. The same secure session works across the apps a user is allowed to access.
FROM CODE TO A RUNNING SERVICE
One small ecosystem,
built with clear boundaries.
Tael is a collection of focused apps that share sign-in and collaborative workspaces while keeping their code, data, and operations separate. This is the public view of how the system works—without details that would weaken its security.
SYSTEM AT A GLANCE
Shared where it helps.
Separated where it protects.
One space for each group
Families and organizations are created centrally. Apps receive only the authorization context they need for the active workspace.
Product-owned data
An app that stores data owns its database, rules, and backups. A failure in one product should not provide access to another.
CONTINUOUS INTEGRATION
Every change follows the same controlled path.
Code does not go live simply because it has been written. It must pass automated and technical checks first.
DEPLOYMENT INTERACTION MAP
One release, six bounded interactions.
Automated trust gate
Code change
A focused change is proposed on an isolated branch.
Review
The exact difference is visible before approval.
Verify & build
Tests, contracts, and security checks must pass.
Locked release
The approved image is stored by immutable identity.
Product update
It may update only its assigned product.
Healthy service
Real readiness must succeed before completion.
Failure path: if readiness fails, the deployer restores the previous approved image and verifies the service again.
- 1
Change and review
Work takes place on an isolated branch. The change remains visible and reviewable before it enters the main version.
- 2
Tests and contracts
CI verifies behavior, buildability, secure defaults, configuration, and that the product still satisfies its deployment contract.
- 3
Immutable container
Approved code is built once into a version-locked container image. The image that passes the checks is the image that may be deployed.
- 4
Security scanning
The container and its dependencies are checked for known serious vulnerabilities. A blocking finding stops the delivery process.
- 5
Scoped deployment
A product's deployment identity can update only that product and accepts only the approved image.
- 6
Health check or rollback
The service's real health response is checked after the switch. If it fails, the previous working version is restored automatically.
TECHNOLOGY
Proven building blocks with a small attack surface.
HTML, CSS, JavaScript, and Node.js
Static pages stay simple. Interactive products use component-based web interfaces and server code where needed.
PostgreSQL and scoped APIs
Stateful apps use their own PostgreSQL databases. The API layer checks identity and access before data leaves the product.
Tael Identity and secure cookies
Sign-in material is kept in protected cookies rather than ordinary browser storage. Short-lived, signed tokens are used between services.
Docker, TLS, and automated CI
Apps run in isolated containers behind a TLS-terminating gateway. GitHub Actions builds, tests, scans, and delivers approved versions.
SECURITY AND PRIVACY
Layers of protection, not a single lock.
- Least privilege.Each deployment identity, app, and database role can perform only its narrowly defined job.
- Isolated runtime.Containers run without administrator privileges, with read-only filesystems and separate network boundaries.
- Secrets outside the code.Keys and passwords are neither committed nor built into public web files or container images.
- Privacy-minimized analytics.Operations and usage are measured through aggregated metrics. Raw IP addresses, referrers, and visitor identifiers are not retained in shared traffic analytics.
- Controlled recovery.Backups and previous approved versions are managed separately so code and data can be restored in a controlled process.
Responsible transparency: This page describes principles and technology choices. Exact network addresses, access rules, secret names, and operational instructions are not published.
READY TO EXPLORE?