Self-hosted, and outward-only by design.

Security here is the shape of the architecture rather than a list of features added afterwards. BARRY is self-hosted: the server runs in your cloud or your own data centre, the metadata lives in a PostgreSQL database you operate, and no data is routed through infrastructure belonging to us. The on-prem client only ever opens connections outward, so there is nothing inbound to your network at any point and no service of yours becomes reachable from outside. Sign-in uses your own identity provider through OIDC – Keycloak, Microsoft Entra ID or another – so accounts, groups and offboarding stay where they already are. Credentials can be stored as references into your own vault.