Decide where your data lives and who holds its keys.
Data stays in the European Union unless you connect your own database, storage and models somewhere else. Hold your own key, and answer every data request in one place.
Verified on 2026-11-08: 9,214 entries, chain head 4b1e07c9d35f62a0.
Verified on 08/11/2026: 31,877 entries, chain head c27a90e14f8d3b56.
Verified on 08.11.2026: 22.391 entries, chain head 5d02b8e7a14c9f36.
Verified on 08/11/2026: 14 720 entries, chain head a6c3f19e0d7b2584.
Verified on 08/11/2026: 40.512 entries, chain head 3e9b07d1c48fa265.
Verified on 08/11/2026: 5,402 entries, chain head f19c7a3b250e8d64.
Verified on 08/11/2026: 27,164 entries, chain head 6a05d9e3b7c14f82.
Verified on 08-11-2026: 35.290 entries, chain head 28c6e04f7b1a9d53.
Verified on 2026-11-08: 9,214 entries, chain head 4b1e07c9d35f62a0.
Verified on 08/11/2026: 31,877 entries, chain head c27a90e14f8d3b56.
Verified on 08.11.2026: 22.391 entries, chain head 5d02b8e7a14c9f36.
Verified on 08/11/2026: 14 720 entries, chain head a6c3f19e0d7b2584.
Verified on 08/11/2026: 40.512 entries, chain head 3e9b07d1c48fa265.
Verified on 08/11/2026: 5,402 entries, chain head f19c7a3b250e8d64.
Verified on 08/11/2026: 27,164 entries, chain head 6a05d9e3b7c14f82.
Verified on 08-11-2026: 35.290 entries, chain head 28c6e04f7b1a9d53.
Verified on 2026-11-08: 9,214 entries, chain head 4b1e07c9d35f62a0.
Verified on 08/11/2026: 31,877 entries, chain head c27a90e14f8d3b56.
Verified on 08.11.2026: 22.391 entries, chain head 5d02b8e7a14c9f36.
Verified on 08/11/2026: 14 720 entries, chain head a6c3f19e0d7b2584.
Verified on 08/11/2026: 40.512 entries, chain head 3e9b07d1c48fa265.
Verified on 08/11/2026: 5,402 entries, chain head f19c7a3b250e8d64.
Verified on 08/11/2026: 27,164 entries, chain head 6a05d9e3b7c14f82.
Verified on 08-11-2026: 35.290 entries, chain head 28c6e04f7b1a9d53.
Verified on 2026-11-08: 9,214 entries, chain head 4b1e07c9d35f62a0.
Verified on 08/11/2026: 31,877 entries, chain head c27a90e14f8d3b56.
Verified on 08.11.2026: 22.391 entries, chain head 5d02b8e7a14c9f36.
Verified on 08/11/2026: 14 720 entries, chain head a6c3f19e0d7b2584.
Verified on 08/11/2026: 40.512 entries, chain head 3e9b07d1c48fa265.
Verified on 08/11/2026: 5,402 entries, chain head f19c7a3b250e8d64.
Verified on 08/11/2026: 27,164 entries, chain head 6a05d9e3b7c14f82.
Verified on 08-11-2026: 35.290 entries, chain head 28c6e04f7b1a9d53.
Verified on 2026-11-08: 9,214 entries, chain head 4b1e07c9d35f62a0.
Verified on 08/11/2026: 31,877 entries, chain head c27a90e14f8d3b56.
Verified on 08.11.2026: 22.391 entries, chain head 5d02b8e7a14c9f36.
Verified on 08/11/2026: 14 720 entries, chain head a6c3f19e0d7b2584.
Verified on 08/11/2026: 40.512 entries, chain head 3e9b07d1c48fa265.
Verified on 08/11/2026: 5,402 entries, chain head f19c7a3b250e8d64.
Verified on 08/11/2026: 27,164 entries, chain head 6a05d9e3b7c14f82.
Verified on 08-11-2026: 35.290 entries, chain head 28c6e04f7b1a9d53.
Choose where data lives, and who holds its keys
Only the business’s owner opens these screens, and each change to where its data lives or who holds its key is written to Activity.
Where It Lives
In the EU, or where you choose.
Your Own Backend
PostgreSQL and S3-compatible storage.
Move In or Out
A move, an export, a delete.
Your Models
Calisto’s, off, or your own.
Your Key
In your own key service.
Sign-In
Your identity provider and directory.
Requests
Erasures reviewed, then erased.
On a Phone
What needs you, first.
See where each part is held, and what stays
Calisto’s application servers and its default database and file storage are in the European Union. There is no region to pick: a business that needs its data elsewhere connects its own database, storage and models there. Each screen lists what stays with Calisto whichever backend you use.
Where Your Data Lives
Calisto’s application servers run in the European Union.
Calisto’s default database and file storage are in the European Union.
To keep your clients’ data in another country, connect your own database, storage and models there.
Providers by Region
Suggested storage and model providers by region, each listed only once Calisto’s own connection tests pass against it.
Where Your Data Lives
What Stays With Calisto
Your account’s control record, the addresses your public pages resolve through, what you publish, billing with Calisto and Calisto Pay orders, and published files.
Where Your Data Lives
Backups
Calisto’s nightly database backups keep a row for up to 30 days after it leaves Calisto’s database.
Database
Calisto’s schema was built in your database on 26/10/2026.
The Residency Register
Declare where each kind of data is held, under which law, on which transfer basis and for how many years, with health data declared on its own.
Residency Register
Checked, Never Enforced
Each declaration is compared with your backend and its provider’s countries: it agrees, it cannot be verified, or it disagrees. Nothing is blocked.
Residency Register
Residency Register
Residency Register
Where Your Data Lives
Connect your own PostgreSQL and S3-compatible storage
Test the connection, build Calisto’s schema in your database with its counts, then switch to it, and back whenever you choose. Storage is tested by writing, reading, listing and deleting a file. Only the owner switches, after a fresh step-up code.
Database
If your own database cannot be reached, work that needs it stops and Calisto tells you. While it is down, Calisto does not keep your records in its own database instead.
Calisto keeps its schema up to date in your database: each update is applied automatically and recorded in your Activity.
Calisto’s schema was built in your database on 10/18/2026.
5987 migrations applied, 0 already there, 1855 tables in your database.
Test ConnectionSave ConnectionBuild SchemaUse Calisto’s DatabaseTLS Always Verified
Every database connection verifies its certificate, with your own CA bundle if you have one, and the test names any extension your database does not offer.
Database
Start on your own backend, or move to it later
An account that holds nothing on Calisto switches at once. One that does moves: changes pause, every record is copied in order and counted, the files follow, the account switches, changes resume, and Calisto erases its copy. Moving back never deletes anything from yours.
Database
Calisto’s schema was built in your database on 2026-11-07.
Between Two of Your Own Databases
Database
Move to This Database builds the new one, copies the records and switches, deleting nothing from either.
Moving Back
Database
If your own database cannot be reached, work that needs it stops and Calisto tells you. While it is down, Calisto does not keep your records in its own database instead.
Your data moves back to Calisto the same way, and nothing is deleted from your own database or storage.
The Account Export
Requests & Export
Every record, the manifest of every file and the Activity head, written into your own storage whenever you ask.
Delete a Business, With Purview
Kanzlei Müller & Novak
A database or storage of its own is left as it is: Calisto erases its copy and drops the connection. Export what you want to keep first, in Sovereign ▸ Requests & Export.
Delete BusinessThis cannot be undone. We’ll email you a code to confirm it’s you.
After an emailed code, its records, files, mailboxes and published addresses are erased everywhere, and Calisto keeps only what the law makes it keep, such as billing and the terms you accepted.
Your Own Backend Left As It Is
Harbour Physio
A database or storage of its own is left as it is: Calisto erases its copy and drops the connection. Export what you want to keep first, in Sovereign ▸ Requests & Export.
Delete BusinessDeleting a business on its own database or storage erases Calisto’s copy and drops the connection. Yours is untouched.
Switch Calisto AI off, or bring your own provider
Calisto AI is on or off for the whole account. Connect your own OpenAI-compatible provider for any capability: it is tested live before it is saved, and its key is sealed by the vault. Your clients’ data is never used to train models.
Calisto AI
- generator: Qwen3-32B (https://models.bluebonnetpediatrics.com/v1)Remove
- classifier: Qwen3-8B (https://models.bluebonnetpediatrics.com/v1)Remove
- vision: Qwen2.5-VL-72B-Instruct (https://oai.endpoints.kepler.ai.cloud.ovh.net/v1)Remove
- embeddings: bge-m3 (https://oai.endpoints.kepler.ai.cloud.ovh.net/v1)Remove
- stt: whisper-large-v3 (https://oai.endpoints.kepler.ai.cloud.ovh.net/v1)Remove
On or Off for the Whole Account
Off turns off every drafting, reading and answering feature in every app, for every business unit.
Calisto AI
Every capability uses Calisto’s models.
Where your business’s data lives, who holds its keys, and what happened to it.
- Where Your Data Lives
- Calisto AI
- Keys
Your Own Provider for Each Capability
Point any capability at your own OpenAI-compatible provider. Calisto tests it live before it is saved, and a capability you leave alone uses Calisto’s models.
Calisto AI
- generator: Qwen3-32B (https://llm.sakura-dental.jp/v1)Remove
- classifier: Qwen3-8B (https://llm.sakura-dental.jp/v1)Remove
- vision: Qwen2.5-VL-7B (https://llm.sakura-dental.jp/v1)Remove
- embeddings: bge-m3 (https://oai.endpoints.kepler.ai.cloud.ovh.net/v1)Remove
- stt: whisper-large-v3 (https://oai.endpoints.kepler.ai.cloud.ovh.net/v1)Remove
- ✓ generator
- ✓ classifier
- ✓ vision
- ✓ embeddings
- ✓ stt
Checks on What You Publish
Public chat, comments and published media are checked on Calisto’s models, whichever provider you use.
Calisto AI
- generator: Mistral-Small-3.2 (https://oai.endpoints.kepler.ai.cloud.ovh.net/v1)Remove
- classifier: Qwen3-8B (https://ia.hotelesolea.es/v1)Remove
- vision: Qwen2.5-VL-72B-Instruct (https://oai.endpoints.kepler.ai.cloud.ovh.net/v1)Remove
- embeddings: bge-m3 (https://ia.hotelesolea.es/v1)Remove
- tts: Kokoro-82M (https://ia.hotelesolea.es/v1)Remove
A Key That Cannot Be Opened
If your provider’s key cannot be opened, Calisto AI stops with an honest error. Nothing goes to Calisto’s models instead.
Novos horários a partir de dezembro
A partir de 1º de dezembro, a Clínica Ipê passa a atender de segunda a sábado, das 7h às 20h, com coleta de exames em jejum a partir das 6h30.
Consultas já marcadas continuam nos mesmos dias e horários. Quem preferir outro horário pode falar com a recepção ou remarcar pelo portal do paciente.
O estacionamento da Rua Harmonia segue conveniado, com as duas primeiras horas por conta da clínica.
Hold your business’s key in your own key service
Connect OpenBao or Vault Transit, OVHcloud KMS or Scaleway Key Manager. Your account’s secrets are sealed under versioned data keys wrapped by yours, rotated when you ask, with a way back to Calisto-managed keys.
Keys
With your own key, each data key is stored only wrapped by your key, in your key service. Revoking your key locks Calisto out of everything sealed under it.
So that a short outage of your key service never stops work, an unwrapped data key stays in Calisto’s server memory for 5 minutes. A revocation therefore takes effect within 5 minutes.
With your own database and storage, your records and private files are at rest under your own provider’s encryption and keys.
- Data key 5 · Active · 2026/10/27
- Data key 4 · Retired · 2026/08/04
- Data key 3 · Retired · 2026/05/05
- Data key 2 · Retired · 2026/02/02
- Data key 1 · Retired · 2025/11/02
Re-sealing: done, 318 secrets moved, 0 failed.
Keys Calisto-Managed
Sign your people in with your company’s identity provider
Add an OpenID Connect or SAML sign-in, and prove each email domain with a TXT record in its DNS. Choose whether a first sign-in creates the person’s Calisto login or admits only people who already have one.
Sign-In
Your people sign in with your company’s own identity provider.
| Sign-In | Kind | For | Status |
|---|---|---|---|
| Kamau & Ochieng Entra ID | OpenID Connect | Your business | Signing people in |
| Safiri Logistics Okta | OpenID Connect | A client company | Signing people in |
| Baraka Bank SAML | SAML | A client company | Signing people in |
| Tsavo Energy JumpCloud | OpenID Connect | A client company | Signing people in |
| Lamu Shipping Okta | OpenID Connect | A client company | Signing people in |
| Rift Valley Tea SAML | SAML | A client company | Signing people in |
| Zawadi Foods Entra ID | SAML | A client company | Signing people in |
| Mwangi Properties Okta | OpenID Connect | A client company | Signing people in |
| Amani Insurance Entra ID | SAML | A client company | Waiting for a proven domain |
| Mutua Holdings Okta | OpenID Connect | A client company | Switched off |
Email Domains Proven by DNS
Each email domain is proven by a TXT record in its DNS, and Check Now reads it again whenever you ask.
Sign-In
Your people sign in with your company’s own identity provider.
| Domain | TXT Record Name | TXT Record Value |
|---|---|---|
| notaria27.mxProven | _calisto-sso.notaria27.mx | calisto-sso-verification=f3a91c07d2e84b16 |
| grupoalcazar.mxProven | _calisto-sso.grupoalcazar.mx | calisto-sso-verification=7be20d94c1a6f385 |
| alcazarinmuebles.mxProven | _calisto-sso.alcazarinmuebles.mx | calisto-sso-verification=c84f16ea09d3b772 |
| fondoreyes.com.mxProven | _calisto-sso.fondoreyes.com.mx | calisto-sso-verification=29d7a3e1b6c05f48 |
| castillohoteles.mxProven | _calisto-sso.castillohoteles.mx | calisto-sso-verification=d40b7e1f86a2c395 |
| mejiayasociados.mxProven | _calisto-sso.mejiayasociados.mx | calisto-sso-verification=5ac18f03e7d294b6 |
| nunezseguros.mxProven | _calisto-sso.nunezseguros.mx | calisto-sso-verification=91f6d2c07b3e48a5 |
| constructorapena.mxWaiting for its TXT record | _calisto-sso.constructorapena.mx | calisto-sso-verification=a15c98f2e7304bd6 |
| santanaabogados.mxWaiting for its TXT record | _calisto-sso.santanaabogados.mx | calisto-sso-verification=60e3bd471f92ca85 |
A Client Company’s Sign-In
Add a client company’s identity provider too, and its people sign in with it. What they can use is still their membership or seat.
Sign-In
Your people sign in with your company’s own identity provider.
An identity provider: your business’s, or a client company’s. Their IT team has the details; Calisto gives them the addresses to enter once it is saved.
Their identity provider’s metadata (XML)<EntityDescriptor entityID="https://idp.groupefontaine.fr/saml"> <IDPSSODescriptor protocolSupportEnumeration="…"> <SingleSignOnService Location="https://idp.groupefontaine.fr/sso"/>Paste it and the three fields below can stay empty.Sign people in with itProvisioning From Your Directory
Connect Microsoft Entra ID, Okta or JumpCloud. A person your directory adds is invited to the business; one it switches off or deletes leaves it.
Sign-In
Your people sign in with your company’s own identity provider.
| Sign-In | Status | Token Ends In | Last Heard From | People | Groups |
|---|---|---|---|---|---|
| Hoteles Olea Entra ID | Directory connected | 9fK2 | 8 nov 2026, 9:40 | 214 | 12 |
| Olea Restauración Okta | Directory connected | x7Qa | 8 nov 2026, 9:35 | 96 | 7 |
| Olea Spa JumpCloud | Directory connected | Lm3T | 8 nov 2026, 8:50 | 38 | 4 |
| Olea Sevilla Entra ID | Directory connected | b0Zs | 8 nov 2026, 9:22 | 71 | 6 |
| Olea Málaga Okta | Directory connected | Ty8c | 7 nov 2026, 18:15 | 54 | 5 |
| Olea Córdoba Okta | Directory connected | Hn4v | 8 nov 2026, 7:58 | 43 | 5 |
| Olea Granada JumpCloud | Directory connected | Wd6e | 8 nov 2026, 8:12 | 29 | 3 |
https://sovereign.calistoco.com/api/sovereign/sign-in/scim/v2A Token Shown Once
The provisioning token is shown once and stored only as a hash.
Sign-In
Your people sign in with your company’s own identity provider.
Directory Groups, With Access
Map each directory group to Access profiles and zones. A person gains those doors while in the group, and leaving the business revokes their keys, cards, codes and passes.
Sign-In
Your people sign in with your company’s own identity provider.
| Group | Sign-In | Members | Opens |
|---|---|---|---|
| Clinicians Amsterdam | Mosaic Entra ID | 42 | Clinical Staff, Consulting Floor |
| Clinicians Rotterdam | Mosaic Entra ID | 27 | Clinical Staff, Rotterdam Clinic |
| Reception | Mosaic Entra ID | 16 | Front Desk, Main Entrance |
| Records Team | Mosaic Entra ID | 8 | Records Room |
| Facilities | Mosaic Entra ID | 11 | Facilities, Plant Room, Loading Bay |
| Night Shift | Mosaic Entra ID | 19 | After Hours, Main Entrance |
| Pharmacy | Mosaic Entra ID | 9 | Pharmacy, Cold Store |
| Laboratory | Mosaic Entra ID | 14 | Laboratory, Sample Store |
| Management | Mosaic Entra ID | 6 | Offices, Records Room |
Access profiles and zones from Access. A member of several groups gets the doors of all of them.
People From Your Directory
Everyone your directory sent, with their standing: on your team, invited, or switched off in your directory.
Sign-In
Your people sign in with your company’s own identity provider.
| Name | Standing | Last Change | |
|---|---|---|---|
| Emily Carter | ecarter@bluebonnetpeds.com | On your team | 10/05/2026 |
| David Hughes | dhughes@bluebonnetpeds.com | On your team | 10/18/2026 |
| Grace Whitfield | gwhitfield@bluebonnetpeds.com | On your team | 10/20/2026 |
| James Morgan | jmorgan@bluebonnetpeds.com | On your team | 10/24/2026 |
| Rachel Palmer | rpalmer@bluebonnetpeds.com | On your team | 10/27/2026 |
| Michael Doyle | mdoyle@bluebonnetpeds.com | On your team | 11/02/2026 |
| Sarah Bennett | sbennett@bluebonnetpeds.com | On your team | 11/04/2026 |
| Laura Morgan | lmorgan@bluebonnetpeds.com | Invited | 11/07/2026 |
| Daniel Bennett | dbennett@bluebonnetpeds.com | Invited | 11/08/2026 |
| Thomas Sinclair | tsinclair@bluebonnetpeds.com | Switched off in your directory | 11/05/2026 |
Sign-In
Your people sign in with your company’s own identity provider.
| Domain | TXT Record Name | TXT Record Value |
|---|---|---|
| notaria27.mxProven | _calisto-sso.notaria27.mx | calisto-sso-verification=f3a91c07d2e84b16 |
| grupoalcazar.mxProven | _calisto-sso.grupoalcazar.mx | calisto-sso-verification=7be20d94c1a6f385 |
| alcazarinmuebles.mxProven | _calisto-sso.alcazarinmuebles.mx | calisto-sso-verification=c84f16ea09d3b772 |
| fondoreyes.com.mxProven | _calisto-sso.fondoreyes.com.mx | calisto-sso-verification=29d7a3e1b6c05f48 |
| castillohoteles.mxProven | _calisto-sso.castillohoteles.mx | calisto-sso-verification=d40b7e1f86a2c395 |
| mejiayasociados.mxProven | _calisto-sso.mejiayasociados.mx | calisto-sso-verification=5ac18f03e7d294b6 |
| nunezseguros.mxProven | _calisto-sso.nunezseguros.mx | calisto-sso-verification=91f6d2c07b3e48a5 |
| constructorapena.mxWaiting for its TXT record | _calisto-sso.constructorapena.mx | calisto-sso-verification=a15c98f2e7304bd6 |
| santanaabogados.mxWaiting for its TXT record | _calisto-sso.santanaabogados.mx | calisto-sso-verification=60e3bd471f92ca85 |
Answer your customers’ data requests, with the record behind them
An access request is answered at once with the person’s records and who opened them. An erasure first lists every record you hold about them, in every app; you approve each record or kind, then erase. You are the controller; Calisto is the processor.
- 01Kept by LawInvoices, payments, the books, client money, signed agreements, paid form responses and identity checks are kept with the person’s details replaced, or kept as they are. Never erased.
- 02Your Own ReasonsEvery other record defaults to erase, and you may keep any of them with your reason.
- 03Walled Matters, With LegalAn owner walled from a matter sees its records with their titles withheld.
- 04The ResultErased, details removed and kept, each counted with its reasons. A record that failed says why, and Try Again retries it. The address is suppressed for good in Campaigns.
- 05One Activity LogCustody changes, access to walled matters and personal data, client money, exports and requests, each entry chained to the one before and verified every day.
- 06It Follows Your DatabaseOn your own database the log lives there, and a move copies the chain so every entry still verifies.
Requests & Export
Requests & Export
Requests & Export
Requests & Export
Erased 41 · Details removed from 6 · Kept 9
Bookings and Reservations: 2 kept. You chose to keep it.
Clinical Records: 7 kept. Health law requires clinical records to be kept for the medical-records period.
Activity
Verified on 08/11/2026: 27,164 entries, chain head 6a05d9e3b7c14f82.
Activity
Verified on 08/11/2026: 6,150 entries, chain head e81d5a2c0b97f43e.
Where your business’s data lives, who holds its keys, and what happened to it.
Invoices, payments, the books, client money, signed agreements, paid form responses and identity checks are kept with the person’s details replaced, or kept as they are. Never erased.
Requests & Export
Every other record defaults to erase, and you may keep any of them with your reason.
Requests & Export
An owner walled from a matter sees its records with their titles withheld.
Requests & Export
Erased, details removed and kept, each counted with its reasons. A record that failed says why, and Try Again retries it. The address is suppressed for good in Campaigns.
Requests & Export
Erased 41 · Details removed from 6 · Kept 9
Bookings and Reservations: 2 kept. You chose to keep it.
Clinical Records: 7 kept. Health law requires clinical records to be kept for the medical-records period.
Custody changes, access to walled matters and personal data, client money, exports and requests, each entry chained to the one before and verified every day.
Activity
Verified on 08/11/2026: 27,164 entries, chain head 6a05d9e3b7c14f82.
On your own database the log lives there, and a move copies the chain so every entry still verifies.
Activity
Verified on 08/11/2026: 6,150 entries, chain head e81d5a2c0b97f43e.
Where your business’s data lives, who holds its keys, and what happened to it.
See what needs you, and answer it from your phone
Home, Activity and Requests are the tabs. Home lists what needs you: erasures ready for review, requests that did not finish, an Activity log that did not verify, a backend that cannot be reached. Then where each part is held, and a door to every screen.
Needs You, First
The Home opens on what needs you, then Right Now: where your database, storage, keys and models are held today.
Where your business’s data lives, who holds its keys, and what happened to it.
Where Sovereign touches everything else.
3 of these 6 connections are in your plan today; the others are their own apps.
Purview
A business is deleted from its record in Purview, after an emailed code, through the one erasure.
Depot
The files Depot keeps move into your own storage with your records, and an erasure removes a person’s files from every copy.
Legal
Opening a walled matter is written to Activity, and an owner walled from a matter sees its records in an erasure with their titles withheld.
Access
A directory group opens Access profiles and zones, and a person who leaves the business loses their keys, cards, codes and passes.
Campaigns
An erased person’s address is suppressed for good in Campaigns.
Ledger
Invoices, payments and the books are kept by law in an erasure, with the person’s details replaced.
No setup cost. Pay when you start using.
Where your data lives and who holds its keys.
Included with every Calisto account
Your own database, storage, models and key, company sign-in and directory provisioning, the Activity log, your customers’ data requests, the account export and the residency register.
Everything included in Calisto Sovereign.
- The owner of the business, never from a station; a fresh step-up code for a switch, a model provider and every key change.
- Calisto’s application servers and its default database and file storage are in the European Union; no region to pick.
- Suggested storage and model providers by region, each listed only once Calisto’s own connection tests pass against it.
- Per backend: the account’s control record, public address routing, what you publish, billing with Calisto and Calisto Pay orders.
- Calisto’s nightly backups keep a row for up to 30 days after it leaves Calisto’s database.
- PostgreSQL: test, save, build Calisto’s schema with its counts, switch to it and back.
- Always verified, with an optional CA bundle of your own.
- The test names any extension Calisto’s schema needs that your database does not offer.
- Every five minutes each own database receives the migrations it does not hold, each recorded in Activity.
- Rotated credentials or a new pooler address are saved; a connection to a different database is refused.
- Move to This Database builds the new one, copies the records and switches, deleting nothing from either.
- Any S3-compatible bucket: save, test by writing, reading, listing and deleting, switch to it and back.
- Use My Database and Use My Storage switch at once while the account holds nothing on Calisto.
- Changes pause, records are copied in order and counted, files follow, the account switches, changes resume, Calisto erases its copy.
- The same move reversed, never deleting from your own database or bucket.
- An unreachable own database, storage or model key gives an honest error and an alert; nothing falls back to Calisto’s.
- One database, storage and model choice per group, made by HQ’s owner and applied to every business in it.
- A business on a different backend moves onto the group’s, then joins; leaving keeps the backend it has.
- On or off for the whole account.
- An OpenAI-compatible provider per capability, tested live before it is saved; its key sealed by the vault.
- Your clients’ data is never used to train models.
- Public chat, comments and published media are checked on Calisto’s models.
- Your own key in OpenBao or Vault Transit, OVHcloud KMS or Scaleway Key Manager, with the way back to Calisto-managed keys.
- Versioned data keys wrapped by your key, rotated on request; an unwrapped data key stays in memory five minutes.
- Secrets sealed under Calisto’s key are moved onto yours by a daily sweep.
- OpenID Connect or SAML, switched on or off, edited or removed; metadata pasted or entered field by field.
- Each proven by a TXT record in its DNS, checked again on request.
- Create the person’s Calisto login, or admit only people who already have one.
- Microsoft Entra ID, Okta or JumpCloud add and remove your people; the token is shown once and stored as a hash.
- A group opens Access profiles and zones while a person is in it; leaving the business revokes their keys, cards, codes and passes.
- Custody changes, access to walled matters and personal data, client money, exports and requests in one log.
- Append-only, each entry chained to the one before, verified daily, with the last verified head shown.
- On your own database the log lives there; a move copies the chain so every entry still verifies.
- Answered at once with the person’s records and who opened their personal data.
- Every record about the person listed across every app, reviewed by record or kind, approved with the step-up, then erased.
- Invoices, payments, the books, client money, signed agreements, paid form responses and identity checks: details replaced, or kept as they are.
- Kept only.
- An owner walled from a matter sees its records with their titles withheld.
- Erased, details removed and kept, with reasons; failures per record, with Try Again.
- An erased person’s address is suppressed for good.
- Every record, the file manifest and the Activity head, written into your own storage.
- Each kind of data (general or health) by jurisdiction, law, transfer basis, local copy and retention years.
- GDPR, LGPD, NDPA, Kenya’s Data Protection Act and POPIA, or none.
- Each declaration compared with your backend and its provider’s countries: agrees, cannot be verified, or disagrees.
- After an emailed code, everything erased except what the law makes Calisto keep; your own backend left untouched.
- The same screens in Settings ▸ Data Custody.
- Every screen in its phone shape; Home, Activity and Requests as tabs; Home lists what needs you.
- Home, Activity and Requests readable with no signal on a device you keep Sovereign on; changes need a connection.
- An unreachable backend and an Activity log that did not verify, as a push, an email and in-app, each opening its screen.
- Data Custody at a Glance on Windows.
- Requests & Export, Activity, Database and Keys from the app’s icon.
- Your own notices about the business’s data custody, and This Device.
Questions about Calisto Sovereign
Calisto’s application servers, and its default database and file storage, are in the European Union. There is no region to pick: to keep your customers, records and private files in another country, connect your own database, storage and models there.
Your account’s control record (members, seats and sign-in), the addresses your public pages resolve through, what you publish, billing with Calisto and Calisto Pay orders, and published files. Checks on what you publish run on Calisto’s models. Each screen lists its part under What Stays With Calisto.
Both. With nothing on Calisto yet, Use My Database and Use My Storage switch at once. Later, changes pause while your records and files are copied into your own database and storage and counted, the account switches, and Calisto erases its copy. Its nightly backups keep the erased copy for up to 30 days.
You see an honest error, and an alert reaches you by push, email and in-app. While it is down, nothing is written to Calisto’s database or storage instead.
You can. Your account’s stored secrets are sealed under data keys wrapped by a key in your own key service. Revoke it, and once the five minutes an unwrapped data key stays in memory have passed, Calisto cannot open them.
No. Switch Calisto AI off for the whole account, or connect your own provider for each capability.
Yes. HQ’s owner chooses one database, storage and models for the group, and every business in it uses that choice. Keys, Activity, requests, exports and the residency register stay each business’s own.
Only the owner of the business, never from a station. Switching a database or storage, saving a model provider and every key change also need a step-up code from the last ten minutes.
No. Every record you hold about them is listed first, in every app. You approve each record or kind, and what the law requires you to keep is kept with their details replaced.
No. Sovereign comes with every account, and every Core app shows the same screens in its Settings ▸ Data Custody.