Company
Born from a decade of WCM implementations in automotive plants.
Not from a market study. The product exists because the same three problems kept appearing on the same plant floors, and the systems built to solve them locally were never going to leave the site they were written for.
Origin
Three half-built plant systems, one product hiding inside them.
Rebuild the code. Keep the domain.
Over roughly a decade, our team built and ran maintenance and WCM software inside automotive plants — the kind of work where the specification arrives as a spreadsheet whose cells say “automatic unique ID by the system”, and where the person who will use the screen is standing behind you while you build it.
What came out of that was three systems, built for the same plants by the same lineage. An execution layer that digitised the annual maintenance ledger and the breakdown record. A methodology layer that ran cost deployment, kaizen and competency management for the review room. And, in the workbooks themselves, a written specification for the workflow engine that should have connected the two.
They were never three products. They were three fragments of one.
Before writing a line of the new product we read the old ones properly: every service in all three codebases, the plant’s own workbooks, the WCM methodology references behind them, and the current market. The conclusion was uncomfortable and clarifying. The runtime was unshippable as a service; the domain knowledge encoded in it was rare.
So WCM One is a clean-room build from written specifications, not a port. The formulas are being re-specified with practitioners rather than transcribed — because the old code contains provably wrong arithmetic, and copying it forward would migrate the bugs along with the wisdom.
It is the difference between a product designed from a competitor’s feature list and one designed from twenty-one plant workbooks. It is why the machine ledger has component instances — because one plant had 192 identical hangers and no appetite for 1,920 rows. It is why closure demands a standardization output, and why the pricing is per site.
The plants are not named here on purpose. Their workbooks and their governance are theirs; what we carry forward is method, not data.
Isolation & residency
Isolation you can point at, line by line.
Machine ledgers are treated as trade secrets even where the law only covers employee records. So every line below names the mechanism rather than the intention, and a mechanism is a thing you can go and read.
tables carry a tenant id, and every one is FORCE-sealed
isolation tests must pass before a change can land
registers hand your data back as real Excel
interface strings, in each of English, Hindi and Marathi
Read off the running cell and its own source tree on 11 August 2026.
- Runs inside your cell
- Every domain and platform service, PostgreSQL, the time-series store, Redis, the event bus, object storage, the identity provider, backups and observability.
- Runs globally — less than this page used to say
- Release artefacts and this website. That is the list. The tenant directory that resolves your slug at sign-in lives in your own cell’s database rather than in a global table, which is a stronger position than the one we previously claimed, and there are no billing counters anywhere because nothing is metered.
- Isolation is structural, and it is tested
- Each cell runs its own identity provider, so a token minted in one is cryptographically invalid at another’s gateway. Inside a cell, every table carrying a tenant id has FORCE row-level security — an owner bypasses row-level security without it, which is a mistake we made and found. A pipeline gate re-proves it on every change by reading the whole cell as a tenant that never existed.
- Routing is regional
- DNS-level regional hostnames, resolved once at sign-in. No global proxy ever sits in the path of tenant data, and no cell carries a config field in which it could name another.
- A cell is stood up from its own migrations
- Not from a snapshot and not by hand: a script builds a whole cell from the migration history, a build guard fails on any hardcoded region identifier, and the application role is created without the ability to bypass row-level security — the cell refuses to boot if it could. Where your plant’s data runs is a decision separate from what the software does, and it is yours to make.
- Vendor authority cannot reach your cell from outside it
- The gateway strips a platform-operator token off every inbound request exactly as it strips a client-supplied tenant id, so the credential is only usable from inside the cell in the first place. That is a control you can point at, which is why it replaced a paragraph about time-boxed elevation that nothing in the code implemented.
AI under residency, stated precisely
Before any prompt is assembled, personal data is replaced with stable per-tenant pseudonyms, with the mapping held in your own database under row-level security and rehydrated only at render. The judgment check renders back the exact pseudonymised text the model was shown — that is, precisely what left the cell, available to read rather than described. Every call writes an audit row carrying tokens and latency and no prompt text.
And then the part most vendors leave to a diagram. We will not describe model inference as confined to a region until the endpoint for that region is verified generally available and the gateway is selecting it — announced is not running, and a residency diagram that quietly means “probably” is worth less than no diagram. What this page claims about where a model call goes, it can point at in code.
One caveat that belongs in the data-processing agreement rather than in a footnote: scrubbing free text is imperfect. Nicknames and transliterated names get through, which is why pseudonymisation is designed to complement placement rather than to stand in for it, and why the audit row exists.
Contact
No address, rather than one that swallows your mail.
There is no address on this page, and that is deliberate rather than an oversight. The one that used to be here pointed at a domain with no mail server behind it — mail to it was neither delivered nor bounced, so every enquiry this site collected disappeared and nobody on either end found out. A contact route that silently drops what it is given is the exact defect this product spends its screens removing, and we are not going to ship it on our own front door.
It comes back the moment there is a mailbox we can promise to answer. Until then: if you already have a workspace, sign in. If you are reading this because somebody sent you the link, they are the route.
- Who we want to talk to first
- Automotive Tier 1 and Tier 2 suppliers running WCM or IATF 16949Plants with a pillar assessment on the calendar in the next twelve monthsGroups where one plant can pilot and the corporate programme can followWCM practitioners who want to argue with our formulas before we ship them
- Where we are
- Built in India · Deployed in your region. Engineering sits in India. What we demonstrate against is a real cell carrying one automotive plant’s real extract, beside a second tenant that exists only to prove the two cannot see each other. Where your own plant’s data runs is a separate decision, and it is yours.