Company
Born from a decade of WCM implementations in automotive plants.
Not from a market study. The product exists because the same three problems kept appearing on the same plant floors, and the systems built to solve them locally were never going to leave the site they were written for.
Origin
Three half-built plant systems, one product hiding inside them.
Rebuild the code. Keep the domain.
Over roughly a decade, our team built and ran maintenance and WCM software inside automotive plants — the kind of work where the specification arrives as a spreadsheet whose cells say “automatic unique ID by the system”, and where the person who will use the screen is standing behind you while you build it.
What came out of that was three systems, built for the same plants by the same lineage. An execution layer that digitised the annual maintenance ledger and the breakdown record. A methodology layer that ran cost deployment, kaizen and competency management for the review room. And, in the workbooks themselves, a written specification for the workflow engine that should have connected the two.
They were never three products. They were three fragments of one.
Before writing a line of the new product we read the old ones properly: every service in all three codebases, the plant’s own workbooks, the WCM methodology references behind them, and the current market. The conclusion was uncomfortable and clarifying. The runtime was unshippable as a service; the domain knowledge encoded in it was rare.
So WCM One is a clean-room build from written specifications, not a port. The formulas are being re-specified with practitioners rather than transcribed — because the old code contains provably wrong arithmetic, and copying it forward would migrate the bugs along with the wisdom.
It is the difference between a product designed from a competitor’s feature list and one designed from twenty-one plant workbooks. It is why the machine ledger has component instances — because one plant had 192 identical hangers and no appetite for 1,920 rows. It is why closure demands a standardization output, and why the pricing is per site.
The plants are not named here on purpose. Their workbooks and their governance are theirs; what we carry forward is method, not data.
Isolation & residency
What is enforced, and what is only promised.
Machine ledgers are treated as trade secrets even where the law only covers employee records. So this section separates the two, line by line, and the promises are labelled as promises.
tables carry a tenant id, and every one is FORCE-sealed
isolation tests must pass before a change can land
registers hand your data back as real Excel
interface strings, in each of English, Hindi and Marathi
Read off the running cell and its own source tree on 11 August 2026.
- Runs inside your cell
- Every domain and platform service, PostgreSQL, the time-series store, Redis, the event bus, object storage, the identity provider, backups and observability.
- Runs globally — less than this page used to say
- Release artefacts and this website. That is the list. The tenant directory that resolves your slug at sign-in lives in your own cell’s database rather than in a global table, which is a stronger position than the one we previously claimed, and there are no billing counters anywhere because nothing is metered.
- Isolation is structural, and it is tested
- Each cell runs its own identity provider, so a token minted in one is cryptographically invalid at another’s gateway. Inside a cell, every table carrying a tenant id has FORCE row-level security — an owner bypasses row-level security without it, which is a mistake we made and found. A pipeline gate re-proves it on every change by reading the whole cell as a tenant that never existed.
- Routing is regional
- DNS-level regional hostnames resolved once at sign-in. No global proxy ever sits in the path of tenant data. Enterprise SSO federation into your own provider is a seam in the code and not yet a feature — the function that would pick your issuer currently ignores what it is asked.
- Backups in jurisdiction is a commitment, not a property
- One cell exists. There is no second region, no disaster-recovery pairing and no backup policy that has ever been exercised against one. The architecture makes it straightforward; nothing here should be read as though it has already happened.
- Vendor authority cannot reach your cell from outside it
- The gateway strips a platform-operator token off every inbound request exactly as it strips a client-supplied tenant id, so the credential is only usable from inside the cell in the first place. That is a control you can point at, which is why it replaced a paragraph about time-boxed elevation that nothing in the code implemented.
AI under residency, stated precisely
Shipped. Before any prompt is assembled, personal data is replaced with stable per-tenant pseudonyms, with the mapping held in your own database under row-level security and rehydrated only at render. The one judgment check renders back the exact pseudonymised text the model was shown — that is, precisely what left the cell. Every call writes an audit row carrying tokens and latency and no prompt text, and a build guard fails on any hardcoded region identifier.
Not shipped. Region-pinned inference. The model gateway takes a model id and an API key and nothing else; there is no endpoint selection in the code, so this page will not claim that inference is confined to your region. It is on the roadmap, it is not in the product, and we would rather you read that here than infer it from a diagram.
Two caveats that belong in the data-processing agreement rather than in a footnote. Scrubbing free text is imperfect: nicknames and transliterated names get through, which is why pseudonymisation will complement region-pinned inference rather than replace it. And we will not promise in-country model inference for a region until the endpoint is verified generally available — announced is not the same as running.
A per-region subprocessor list will be published and versioned before any customer data is processed, and we will standardise on model tiers with zero data retention. Both are commitments in the future tense, because neither has happened.
Contact
No address, rather than one that swallows your mail.
There is no address on this page, and that is deliberate rather than an oversight. The one that used to be here pointed at a domain with no mail server behind it — mail to it was neither delivered nor bounced, so every enquiry this site collected disappeared and nobody on either end found out. A contact route that silently drops what it is given is the exact defect this product spends its screens removing, and we are not going to ship it on our own front door.
It comes back the moment there is a mailbox we can promise to answer. Until then: if you already have a workspace, sign in. If you are reading this because somebody sent you the link, they are the route.
- Who we want to talk to first
- Automotive Tier 1 and Tier 2 suppliers running WCM or IATF 16949Plants with a pillar assessment on the calendar in the next twelve monthsGroups where one plant can pilot and the corporate programme can followWCM practitioners who want to argue with our formulas before we ship them
- Where we are
- Built in India · Deployed in your region. Engineering sits in India. The only cell running today is the demonstration cell — one box, two tenants, one plant’s real extract — and it is not a production region. Where your plant’s data runs is a separate decision, and it is yours.