Your people build the apps. The platform keeps the rules.
Fabrika is a platform your company builds its own apps on, and a team behind it. No app can get around sign-in, permissions, keys or deployment, whether a person or an AI wrote it. The platform is open source and runs in a cloud account in your company's name.
Shared with no other company.
No public address for any app.
By a person, before every deploy.
What every app gets, and can't switch off
Your person with AI builds the screens and the process logic; all of this stays out of their reach.
One installation per company
In a cloud account in your company's name, usually on Zerops, alongside the apps' database, jobs, e-mail and files. If you need to stay in AWS, we set it up there.
A single gate
Every request goes through one entry point that lets in only verified users; with missing or unclear access rules it stays shut. Security headers including HSTS, rate limits on sign-in and public forms, and outgoing calls only to declared addresses.
Sign-in with your company account
One sign-in for all apps through your identity provider over OIDC (Entra ID, Google Workspace, Okta). When someone leaves, block them there and in Fabrika's IAM. People without a company account use a password no admin can set or read.
Roles and permissions
Per app: the app declares its roles, you decide who gets which. A new version won't overwrite what you set.
App keys and passwords
Held by the cloud provider, not our database. Each app sees only its own, and they can be written but never read back.
Separate environments
Testing can't touch production data. On the smallest size, apps in one environment may share a PostgreSQL service, each with its own schema.
A record of what happened
Sign-ins and access changes go into an audit log in the console. Every deployment has a record with a log.
Errors and outages
Errors from all apps land in one place, grouped and assignable. The platform checks apps respond and alerts on a new error or a spike.
A person reviews every change before it goes live
A layer on top of the platform's rules: our service, not a script. Nothing reaches production any other way.
Your person builds
With AI, on their own computer, from the brief and the code.
The change goes to Git
With an author, a time and a description. Nothing is copied onto the server by hand.
We review it
Permissions, data handling, anything that could open access that should stay closed. A deploy that widens access also waits for a person to approve it in the console.
Deployment and report
The version goes live with a record, and you get a report: what changed, what we checked, how it came out.
The AI works with the brief and the code, not your production
The AI builds, it doesn't operate
The production database sits in a private network and the apps have no public address. The AI only gets data if someone deliberately gives it some.
Your own AI plan
Always your own plan with the provider you choose, under your terms, and we don't train anything on your data. We're happy to advise on the provider.
What you can rely on
The exact wording of the commitments is in the contract.
Without a verified sign-in, nobody gets into the non-public parts of an app.
Everyone sees only what their role allows.
We keep the platform patched, without you having to ask.
When something goes wrong, we help find out what happened in the app and with the reporting you're required to do.
What we don't vouch for
What a person does with data they're allowed to see. If an employee exports the records and walks off with them, the platform won't stop that; who gets which role stays with you.
How a company introduces Fabrika
From the first call to the first app in production. The order is always the same; how long it takes depends on what you bring.
- 01
Scoping call
Together, 30 min, free
We go through what you want to run on Fabrika and which way in suits you: a new app, one you already have, or your own developers. Then you get an offer with the scope, timeline and price.
- 02
The platform in your cloud account
Us, or your IT
One installation in a cloud account in your company's name, usually on Zerops, on AWS on request. On Zerops your IT can also install it themselves from the public code and check every step.
Install it yourself - 03
Company sign-in and the first administrator
Your IT, with us
We connect your identity provider over OIDC (Entra ID, Google Workspace, Okta), so people sign in with their company account and MFA works the way you have it set up. Your administrator gets an enrollment link and manages people in the console from then on.
- 04
Ground rules
Together
Rules for working with AI, the AI provider on your own plan, and backups: what, how often, how long they're kept and how fast it has to be back. Also how long access records are kept.
A policy template for AI-built apps - 05
The first app
Your person, with us
Either we build it with your person in a one-week kickstart (Mon we map the process, Tue–Thu we build, Fri it runs for real), or we take over an app you already have and hand its sign-in, keys and deployment to the platform. You decide who gets which role.
- 06
Day to day
Your people build, we review
Every change goes through Git and we review it before it goes live; a deploy that widens access also waits for approval in the console. We keep the platform patched and watch errors and outages. The monthly plan starts only once an app runs in production.
Regulations apply to your own apps too
Meeting them is up to you. For the part about the apps, we give you the groundwork.
An app with personal data needs appropriate security, regular testing and breach reporting to the authority within 72 hours. Company sign-in, roles, change review and deployment records are part of that security.
Under the Czech Cyber Security Act (No. 264/2025 Coll.), even the lower regime requires security rules for development and maintenance, and supplier contracts covering change management, exit and secure development (Decree 410/2025 Coll., Section 3 and Annex 2). Significant incidents are reported within 24 hours.
In finance, DORA requires review and testing before deployment, explicitly including apps built outside IT. That's how changes get into production here.
This isn't legal advice. How a regulation applies to you is for your lawyer or auditor; we'll gladly give them the technical details.
Questions from a security questionnaire
All 44 are in the prefilled questionnaire, and we're happy to fill in yours.
Where does the data live?
In your company's own installation and cloud account, shared with no one. Usually on Zerops, a Czech company with a data centre in Prague; on AWS on request, in a region that meets your requirements.
Who has access to production?
The people you grant it to, and us as far as review, deployment and patches need. Platform sign-ins and access changes are logged in the console; access to the cloud account itself stays with you.
What about multi-factor authentication?
With a company account, MFA works the way your company has it set up at your identity provider. MFA for password sign-in is in progress.
What about backups and recovery?
It's our service, not something the platform does on its own. When setting up Fabrika we agree what gets backed up, how often, how long it's kept and how fast it has to be back.
Who are your subcontractors?
For Fabrika, only us. The cloud account (Zerops, or AWS) is in your company's name and the AI runs on your own plan, so you deal with both directly and we resell neither.
What if we part ways?
The code is yours, the data and domains are in your account. The system keeps running without us and the next person picks it up from Git.
Go through it with our engineer.
Half an hour for your IT on hosting, sign-in, permissions and change review. Bring your questions or your questionnaire.