Identity, privacy, and data flow

Local: processing on your computer

Your browser calls a runner on the same computer. The runner uses your local Azure CLI connection to query Azure and saves the workspace locally. Those Azure responses do not pass through a Papliba-hosted backend in Local mode.

Network access is still required for Azure, GitHub, and sign-in. If enabled, the AI assistant sends prompts and script contents to the configured AI service. External currency-rate requests are off by default. Local does not mean that all data stays offline.

Hosted: processing on the hosting server

In Self-hosted, the backend runs on your organization’s server. In Cloud, it runs on Papliba’s server. The browser sends application requests there; the backend obtains delegated Azure access, queries Azure, and processes the returned information. Saved workspace state, sessions, credentials, and policy evidence are held on that server.

Neither hosted option meets a strict requirement that Papliba processing remain only on each developer’s machine. Select Local when that is the requirement.

Microsoft sign-in and Azure access

Microsoft collects the Microsoft password on its sign-in service. Papliba receives identity information and establishes a session; it does not collect that password. Connect Azure requests a separate delegated ARM token under the signed-in user’s permissions.

Hosted session tickets and tokens are encrypted on the server. The browser receives a session cookie, an antiforgery token, and a workspace identifier. Signing in is not the same as connecting Azure. When the delegated token expires, reconnect Azure.

Workspace isolation

Hosted workspaces are keyed to the admitted tenant and signed-in user. Two people in one tenant do not automatically share files or workspace state. Tenant admission is configured by the operator. Inventory never uses a fallback Azure CLI identity on the server.

Infradraw drafts are an exception to server persistence: they stay in browser storage, separated by workspace. Use separate browser profiles on shared computers.

This public website

Product pages and guides do not connect to Azure, request credentials, or contact a local Papliba runner. Guide search runs in your browser. No advertising or analytics SDK is added by these pages. The hosting provider still receives normal web requests, including the visitor’s IP address; this is not a zero-log promise.

Before onboarding users

• Review the chosen hosting location and enabled external integrations against your organization’s requirements.
• Verify real Entra sign-in and consent, HTTPS, two-user isolation, and database backup and restore.
• Protect database backups, persistent keys, private certificates, and administrator configuration.
• Set a retention policy; automatic private-data retention and cleanup are not implemented in this release.