One codebase. Deployed on your terms.
From managed SaaS to a fully air-gapped install — the same product, with the control posture that banks and governments require.
One codebase. Deployed on your terms.
From managed SaaS to a fully air-gapped install — the same product, with the control posture banks and governments require.
SaaS · BYO-DB · On-prem
Managed SaaS
HostedWe host and operate it, multi-tenant. Every workspace gets its own isolated database; tenancy is resolved from the token and fails closed.
- Per-tenant database isolation
- Region-pinned for residency
- JIT, consented break-glass support
BYO-Database + your keys
SovereignBring your own PostgreSQL and customer-managed keys. We run the app; you hold the encryption key — revoke it and access stops instantly.
- Customer-managed keys (BYOK/CMK)
- Envelope-encrypted PII
- Revocable kill-switch
On-prem / air-gapped
Banks & govHost the entire stack in your data center, single-tenant. Zero standing vendor access; support is escorted and customer-recorded.
- Signed, air-gap release bundles
- Zero standing vendor access
- You own keys, backups & restore
You decide where data lives and who holds the keys
Data sovereignty isn't a checkbox — it's a deployment model. Choose the posture that matches your regulator and your risk appetite.
Database-per-tenant
Every workspace gets its own isolated database; tenancy is resolved from the token and fails closed when unresolved.
Region pinning
Pin a tenant to a region for data residency, so personal data stays within the jurisdiction you require.
Customer-managed keys
Bring your own keys (BYOK/CMK) with envelope-encrypted PII — revoke the key and access stops instantly.
Consented break-glass
Support access is just-in-time and consented; on-prem it is escorted and customer-recorded, with zero standing access.
Air-gapped releases
Signed, air-gap release bundles let you run the entire stack in your own data center, single-tenant.
You own backup & restore
On-premise, you own keys, backups and the restore path end to end — no dependency on the vendor to recover.
Frequently asked questions
Can we keep all data in our own data center?
Yes. The on-prem / air-gapped tier runs the whole stack single-tenant in your environment, with signed release bundles, zero standing vendor access and escorted, recorded support.
What does BYO-database give us?
You bring your own PostgreSQL and customer-managed keys. We operate the app; you hold the encryption key. Revoke it and data access stops immediately — a real, enforceable kill-switch.
How is SaaS isolated between customers?
Each workspace has its own database. Tenancy is resolved from the token, re-verified every request, and the data context fails closed when no tenant is resolved.
Run payroll and HR for your whole group — on one governed platform.
Book a demo and see HRMSTONE run multi-country payroll, statutory filing and approvals — as SaaS, or on-premise for banks and government.