TatteredNote is self-hosted end to end. There's no vendor cloud in the data path, no SaaS backend syncing your incident narratives anywhere — the platform runs entirely on infrastructure you own and control.
This describes an architecture posture, not a compliance certification. TatteredNote is designed around self-hosted deployment, field-level classification, and audit logging because those are the right defaults for ITAR/CMMC-adjacent environments — but neither we nor this page can certify your deployment as compliant. That determination is yours to make with qualified export-control counsel, applied to your specific data and configuration.
Runs on your own infrastructure. No cloud dependency, no vendor-hosted backend in the data path.
Individual records — and fields within a record — can be flagged as controlled technical data, not just walled off at the whole-document level.
User roles carry citizenship and clearance attributes, so access to controlled fields is enforced by who someone is, not just what group they're in.
Every view and edit of a record is logged — who, what, when. Nothing is a black box after the fact.
Records are enforced append-only at both the application and database layers. Nothing is silently edited or deleted, including votes and outcomes.
Offline writes on floor devices are append-only and unclassified by default. Records flagged as controlled are never cached to a device — only queried live.
Manufacturers running more than one site can deploy a hub-and-spoke configuration: each facility runs its own local instance, with controlled replication back to a central hub rather than a single shared database every site writes into directly.
A site's data lives on that site's hardware first. Replication is deliberate, not a default open pipe between locations.
Shared tag vocabulary and solution ranking can propagate across the hub without forcing every site onto identical local configuration.
TatteredNote is pre-launch. If your team is evaluating it for a controlled-data environment, we'd rather walk through the actual architecture and your specific data-handling requirements directly than have you infer answers from a marketing page.
Tell us about your environment and what you'd need to see before this could run in it.
Get in touch