Local sources
Installers, DSM folders and payloads remain in the browser during analysis.
Local core. Controlled platform.
Package contents remain in the browser; server features are limited to accounts, standards and audit metadata.
Encrypted package storage
After the local build, only the generated ZIP can be stored encrypted in the personal package catalog.
Vendor sources
Package templates only reference HTTPS sources with allowlist, redirect and private-IP checks.
Manual publishing
Automated version checks never publish packages. Approval remains an internal, auditable step.
Controlled export
The browser builds the package. Private storage of the generated ZIP is visible and can be disabled before each export.
Explicit AI selection
The assistant sends only sanitized metadata to the selected cloud provider. Personal API keys are session-only or encrypted, with no silent provider switching.
No false assurance
Every package must be tested on a real Windows system and in Intune before production.