nit itself needs none of thisThe enterprise edition is licensed
No buy
button.
The enterprise edition is licensed rather than sold from a page. Starting is an email that a person reads.
If what you want is nit, none of this is in your way: it is free, it is yours, and nobody has to hear from you.
01 The first email
Seven things, and then somebody can actually start.
Copy the block and edit it. Everything in it is something an operator has to have before they can type a command.
To: xampydev@gmail.com
Subject: Audit vault — Acme SA
Company Acme SA
Tenant acme-prod # what our deployment will report as
Deployments 2 # edge-paris-1, edge-lyon-1
Keep records 365 days # our obligation, not a guess
First owner dana@acme.example # a person, not a shared inbox
We host nit ourselves and will host the vault too. We would rather deploy it
ourselves from the binaries than have you do it with us. Our directory is
Keycloak, and today we only want it for group membership. Two subsidiaries
join next year and will want their own trail.The company name
It goes on the account and on the invoice.
A tenant id, or ask for one
A tenant is one deployment's worth of trail, and the id is the string your nitd reports. Three subsidiaries each running their own nit is three tenants under one account: one invoice, three separate trails.
How many deployments, and what to call them
One per place nit runs. The names are what somebody reads to work out which of four deployments stopped sending.
How long records must be kept
In days, from whatever obligation you are under — it is the number you will be asked about in an audit. If you need longer than a plan holds, say so; that is the conversation, not a refusal.
Who administers the vault
A person and their address, not a shared inbox. They hold the first owner role, and every other role is granted from there — on the record, by somebody, rather than inherited from a directory group.
What your directory is for, if you use one
Signing in to the console is OIDC and is configured here. Deciding who is in a team is a read-only account against your Keycloak or LDAP, configured on your side and never reaching us. Most start with the second.
Anything that does not fit
Say it plainly. An exception agreed up front is recorded against your account; one discovered later is a support conversation.
02 What happens after you send it
Five steps, in this order, and a person does each one.
Everything runs on your infrastructure — nit and the vault both. We can deploy the vault with you, or you take the binaries and deploy it yourself.
01 A person reads it and writes back
Not a form handler and not an autoresponder. The reply usually contains a question rather than a brochure.
02 The licence and the shape of the deployment are agreed
How many deployments send, how long records are kept, and anything that does not fit a plan. An exception agreed now is recorded against your account; one discovered later is a support conversation.
03 The vault goes up on your infrastructure
We deploy it with you, or you take the binaries and deploy it yourself — whichever suits how you already run things. Your machines, your database, your backups.
04 You generate a signing key, and the first batch is checked
On your own machine. The private half stays in the control plane and the vault is registered against the public one. A signature mismatch found now is a configuration question; the same mismatch in six months is an incident.
05 You get, in writing, what you are licensed for
The plan, the retention in days, the ids, and any exception agreed. A receipt says what you paid; it does not say how many days your records are kept for.
03 Two answers that are no
Before you ask.
We will not take your signing key. Not even if you offer it, and not to save you a step. The whole claim is that a record in the vault is one the vault could not have written — generate the pair anywhere but your own control plane and the signer and the store stop being separate, and every sentence about the trail becomes false with nothing in the data to show it. If anybody ever asks you for the private half, including us, that is the moment to refuse.
We will not host any of it for you. Authorizing a push means reading the paths inside the patch, so a control plane we ran would be one that sees your source — and a vault we ran would be us holding your evidence, which is the opposite of what makes it evidence. Both run where you run them.
04 Reporting a vulnerability
A separate address, and it is not a sales address.
Please do not open a public issue for anything that lets somebody read a file they should not.
What helps: which version, what you did, what you expected, and what happened instead. A proof of concept is welcome and is never required — a clear description of the mechanism is worth more than a script we cannot run.
You will get an acknowledgement from a person. If you want credit in the fix, say so and how you want to be named; if you would rather not be named, that is the default.