Security & deployment
Deploy it where your data already lives.
Decretum runs identically as a managed cloud service or as a self-hosted deployment on your own infrastructure. It's the same application either way, so the choice is about where the data sits, not which features you get.
Cloud-hosted
We run and maintain the application for you. Fastest way to get a team started, with no infrastructure to operate.
On-prem, via Docker
Run Decretum inside your own network, with your own database. Nothing about a decision or its discussion leaves infrastructure you control.
Access & identity
Sign in with the identity provider you already use
Email and password, Google, or Microsoft Entra ID, so access follows the accounts your organization already manages, rather than a separate password to keep track of.
Role-based access control
Every decision record's visibility, and who is permitted to approve or reject it, is governed by role and by explicit collaborators, never left to "whoever finds the link."
Encrypted in transit
All traffic between a browser and Decretum, cloud or self-hosted, is served over TLS.
Data residency, your call
A self-hosted deployment keeps the database inside your own infrastructure and region. Organizations with strict residency or compliance requirements can run Decretum entirely on hardware, or in a cloud tenant, that they already control.
Tenant isolation, enforced by the database
Every organization-scoped table is restricted by a Postgres row-level security policy, enforced by the database itself, not only by application code. A query that somehow reached the database without its organization context set fails outright, rather than silently returning another organization's data.
Questions about a specific requirement?
See the FAQ for more on how Decretum fits alongside the tools you already run, or reach out directly once you're inside the app.