Security & deployment
Deploy it where your data already lives.
Decretum runs identically as a managed cloud service or as a self-hosted deployment on your own infrastructure. It's the same application either way, so the choice is about where the data sits, not which features you get.
Cloud-hosted
We run and maintain the application for you. Fastest way to get a team started, with no infrastructure to operate.
On-prem, via Docker
Run Decretum inside your own network, with your own database. Nothing about a decision or its discussion leaves infrastructure you control.
Access & identity
Sign in with the identity provider you already use
Email and password, Google, or Microsoft Entra ID, so access follows the accounts your organization already manages, rather than a separate password to keep track of. Self-hosted deployments can also connect to any OpenID Connect-compliant identity provider they run themselves, such as Keycloak, for sign-in that never needs internet access.
Role-based access control
Every decision record's visibility, and who is permitted to approve or reject it, is governed by role and by explicit collaborators, never left to "whoever finds the link."
Encrypted in transit
All traffic between a browser and Decretum, cloud or self-hosted, is served over TLS.
Data residency, your call
A self-hosted deployment keeps the database inside your own infrastructure and region. Organizations with strict residency or compliance requirements can run Decretum entirely on hardware, or in a cloud tenant, that they already control.
Tenant isolation, enforced by the database
Every organization-scoped table is restricted by a Postgres row-level security policy, enforced by the database itself, not only by application code. A query that somehow reached the database without its organization context set fails outright, rather than silently returning another organization's data.
AI and your data
People decide. Decretum keeps the record.
No AI on your content
Decretum doesn't send your decisions, discussions or attachments to any AI service, and they're never used to train AI models. Search runs in Decretum's own database.
Any AI feature is your choice
If Decretum adds AI-assisted features, such as drafting a decision from an email thread, they stay off until your organization's admin turns them on, and we name the provider and where it runs before that. Self-hosted deployments can use their own model.
People write the record
Every decision is made and approved by named people. AI never writes to the record on its own: whatever it drafts, a person reviews and saves.
Questions about a specific requirement?
See the FAQ for more on how Decretum fits alongside the tools you already run, or reach out directly once you're inside the app.