CodeMonster.ai · by Knomatic For the person who has to say yes.
A builder on your team wants to use CodeMonster. This page answers your questions in your order: what the AI can do, what it cannot, what you can request, and how a purchase moves through your organization.
The short version: a real backend under every app; an AI that acts only through named, guarded operations, with the permissions of the person running it; environments you can promote and roll back. Apps and data run on managed cloud infrastructure we operate, built primarily on AWS. The backend is not self-hostable.
Your questions, in your order
Auth model, tenancy, RBAC, rollback, where data lives, whether the vendor will still exist, and what happens when the AI gets it wrong. Short answers below; each row links to the page with the receipts.
| Your question | Short answer | Where documented |
|---|---|---|
| Auth model | A bearer token validated on every request; an unauthenticated call gets a bare 401 with no tool list or server details. The AI acts with the permissions of the person running it — the token is forwarded and the platform authorizes. SSO: Auth0, SAML, Google, or Firebase. | Architecture |
| Tenancy | Row-level, within your account: a tenant column on every object table, filtered automatically, and an explicit tenant context required for every data write. Isolation at the data layer — not dedicated infrastructure per customer. | Data and tenancy |
| RBAC | Groups gate screens, actions, and grids, evaluated server-side. Custom-frontend environments carry owner, editor, and viewer roles; promotion to production and production rollback are owner-only. | Governance and audit |
| Rollback | Non-destructive: a new deployment pointing at the previous successful version, audit trail intact. Every deployment is an append-only record — version, environment, who, when, result. | Environments |
| Data location | On managed cloud infrastructure we operate, built primarily on AWS. Not self-hostable. Regional placement, subprocessors, and encryption status are stated on the compliance page — including what is not yet documented. | Compliance status |
| Vendor longevity | Built and operated by Knomatic on a backend that has carried enterprise workloads for twelve years. The AI-native control surface is new; the backend under it is not. | About |
| When the AI gets it wrong | It cannot inject arbitrary code; it calls named, guarded operations with the user’s permissions. Edits are staged, previewed as an entity-level diff, and committed once; an abandoned transaction rolls back after sixty seconds. A per-solution freeze flag makes every AI write fail with a 403. | Governance and audit |
What builders can and cannot do
Builders work through an authenticated control surface of approximately 100 named operations, reads and writes together — create-object, add-field-to-form, set-object-permissions — each executed with the builder’s own permissions, never the AI’s.
Builders can:
- Assemble apps from governed platform primitives — objects, forms, workflows, grids, screens, groups, permissions — through those named operations.
- Stage edits in a transaction, preview the entity-level diff, commit once, or roll the transaction back.
- Deploy custom frontends (Vite/React static builds) to dev, promote to staging, and — as an owner — promote to production or roll it back.
- Publish platform apps and read the change log on any record where it is enabled.
Builders cannot:
- Inject arbitrary code into the backend. The agent never sees raw solution JSON and never writes it.
- Run server-side code of their own. Custom frontends are static builds; custom backend functions are on the roadmap, not shipped.
- Exceed their own permissions. The AI holds no credentials of its own.
- Edit a frozen solution. With the freeze flag set, every AI write fails with a 403 until a human lifts it.
- Write data without naming a tenant. Writes fail fast with “Tenant context required”.
- Promote out of order. Custom-frontend promotion is one-way — no skipping tiers, no promoting backwards.
The desktop app connects a builder’s existing AI agent to the platform over that authenticated surface. It makes outbound HTTPS calls to the MCP endpoint and the platform API and runs no listening service, so there is no inbound rule to open, and the agent holds no administrator rights on your backend. What it sends and does not send is listed on the download page, where endpoint requirements for managed machines will be published with the installers.
Artifacts you can request
We would rather hand you a document than a badge. Request any of these from security@codemonster.ai or through contact.
- Security overview — auth model, tenancy, governance, and hosting in one document, on request during procurement. Today it is the security hub compiled into one document and sent in writing.
- Architecture references — to be published on codemonster.dev when the documentation site goes live; on request until then.
- Data Processing Agreement — on request during procurement. The public draft at /legal/dpa is pending counsel.
- Subprocessor list — published on the compliance page and at /legal/subprocessors, with what each processes.
- Compliance status — an honest status page rather than badges we have not earned: what is in place, what is on request, what is not yet documented.
- Vulnerability disclosure policy — at /security/vulnerability-disclosure, referenced from
/.well-known/security.txt.
How an organization license moves through procurement
The contracting entity is Knomatic, which builds and operates CodeMonster.ai. One organization license covers every builder and every app; there are no seats to count and no usage to reconcile. Pricing is quoted, not listed: how the license works sets out the shape, and the meter carries the arithmetic against per-token and per-credit models. When you are ready for a number, talk to us.
Your security questionnaire is answered from the security hub and the compliance status page; where an item is not documented, the answer says so rather than guessing. The DPA is signed on request. Terms and the privacy policy are at /legal, marked as drafts until counsel signs off.
Most reviews start with a pilot scoped around one real use case: your builder builds it, you watch the operation log, and the questions get answered in the room. The order-form and invoicing steps are being finalized for launch; ask and we will send the current version in writing.
And the bill: one organization license, unmetered — including your live apps. No tokens. No credits. No meter. You bring the AI subscription you already pay for.
The catch, stated plainly: platform-built apps run on the platform. Your object data exports through a documented API and your custom frontends are ordinary repositories you already hold; the primitives underneath a platform app do not leave with you. Ownership has the whole trade in writing.
Bring us to the room
The fastest review is a 30-minute call with your builder present. They describe the use case, we build it live, and you ask the security questions while the operation log scrolls. Bring the questionnaire — book the demo and add your builder to the invite.