In development

bAIbel TMS is in development. It is not on sale, and nothing here is an offer.

bAIbelTMS
/tms/deploy

Running it

One instance per client organisation, on our infrastructure or on yours. Four images at one version. The operational commands live inside the image that runs the service, so the thing you upgrade and the thing you diagnose are the same artefact.

What follows includes what we do not do, because that is the part you will want to have known.

One instance. One organisation.

Your own database, your own object storage, your own installation. Not a tenant with a column separating you from somebody else.

Four images, one version, upgraded together.

The API and the three front ends release in lockstep at a single version. There is no combination to work out and no matrix to support.

See it in the applicationHide the screenshot
THREE WAYS IN Somebody inside a person in the organisation uploads Their own customer drops a file off through a web page Another system delivers one automatically All three take the same route and are recorded the same way. ONE INSTALLATION, ONE CLIENT ORGANISATION — THEIR INFRASTRUCTURE OR OURS FOUR IMAGES, ALWAYS AT ONE VERSION tms-api the application tms-client the people who do the work tms-designer the route a document takes tms-portal the organisation's own customers Released in lockstep. No compatibility matrix. The application's address is runtime configuration, so the same images run in every estate. TWO DATA STORES — ORDINARY DEPLOYMENTS, NOT BUNDLED IN OUR IMAGES PostgreSQL structured data S3-compatible object storage files ONE PREREQUISITE, AND IT IS NOT IN THE IMAGE A document renderer — your client installs it, and points one value at it A job that requires it is refused before it starts, not after the AI model work has been paid for Language model providers, over HTTPS which providers is a configured decision — an in-house model is governed the same way ONE WAY OUT Nothing phones home. No telemetry, no usage reporting, no licence check-in.
Where TMS sits in an estate — four containers, two data stores, three ways in, one way out

The application never migrates itself.

Only the explicit migration command holds the right to change the schema. A service that started and quietly upgraded your database is a service that can do that during an incident.

See it in the applicationHide the screenshot
ONE OF THESE MAY CHANGE THE SCHEMA The running application never migrates. Not at startup, not ever. --migrate the same image, a different verb BLOCKED The schema your client’s database A service that started and quietly upgraded your database is a service that can do that during an incident. AND IT REFUSES A SCHEMA IT DOES NOT MATCH — IN BOTH DIRECTIONS Behind — the database is newer than the service The obvious one. Refused. Ahead — the service is newer than the database The one people forget. Refused too. A rolled-back service against a migrated database is the failure that loses data rather than throwing an error. And every migration says what it will do to you, first. Each one declares its impact, and anything above a backfill will not run until somebody accepts it by name. A migration that will lock a large table for minutes is a thing you find out before the maintenance window, not during it.
The migration gate — the application never migrates itself

And it refuses to run against a schema it does not match — in both directions.

Behind is refused. Ahead is refused too, which is the one people forget: a rolled-back service against a migrated database is the failure that loses data rather than throwing an error.

Every migration says what it will do to you.

Each one declares its impact, and anything above a backfill will not run until somebody accepts it by name. A migration that will lock a large table for minutes is a thing you find out before the maintenance window, not during it.

The image is also the toolbox.

Preflight. Schema status. Impact. Drain. Admission gates. Backup status. Diagnose. Ledger export and replay. All of them are the same image you are already running, forked before the service starts.

Backups are a ledger, and the ledger records failures.

A backup that did not happen is a row saying so. A backup nobody has restored is a file, so the restore is drilled — and the drill reads the number of errors the restore ignored, because a restore tool exits successfully having skipped things.

Nothing in TMS schedules a backup.

You do, with the tools you already use, or we do as part of running it for you. We would rather say that plainly than have you assume a scheduler exists.

An installation has a name, and a backup knows whose it is.

Restoring one organisation's backup into another's installation is detected rather than silently performed.

A restore does not quietly undo an erasure.

Capture the erasure ledger before the restore; replay it after. The replay claims the work and the running service performs it — and admission will not reopen while claims are outstanding.

1 Capture the ledger 2 Restore the backup 3 Replay the ledger 4 Admission reopens Erasure ledgerPerson 41: erased The database, after the restore Person 41: back from the backup Person 41: erased again Admission closed while the replay is outstanding Replay done. Admission reopens.

A support bundle carries no configuration values.

Including a configuration value that was copied into a row somewhere. The diagnostic output is built from an allow-list, not a list of things to redact.

On-premise: what travels, and what does not.

You can run it entirely on your own infrastructure. Nothing phones home: no telemetry, no usage reporting, no check-in. And the other side of the same statement — we prescribe, provide and verify nothing about your backups. That is a published boundary, not an oversight, and anything that contradicted it would contradict a promise.

The renderer, and what happens when it is missing.

Producing a Word or OpenDocument deliverable needs a document renderer. Where one is not present, a run that requires it is refused at admission rather than failing after the translation has been paid for, and a run that does not require it delivers Markdown and says so.

The renderer is a named prerequisite, not a bundled binary.

The on-premise image ships without it; you install it and point the configuration at it. That is a licensing decision taken deliberately, and it is the reason the prerequisite exists rather than an inconvenience we failed to remove.