The business wants a portal. Here is what that means for you.
Nuclicore is an AI engineering department that the business side operates. This page is written for the person who has to say yes: what we need from you, what you get, and what you will not have to build, run or migrate.
Stack
React 18 and TypeScript, Express and TypeORM, Postgres, Docker. Standard code in a git repository you can export to GitHub at any time.
Hosting
Azure in the EU, or on Enterprise: Hetzner in Germany, single tenant, your own AWS, Azure or GCP account, or a restricted environment.
Release control
Preview, test and production with their own databases and secrets. Security gate on every build. A named person approves. Every release redeployable.
Evidence
Architecture description, penetration test summary, sub-processor list and DPA template on request. Nightly ZAP scan reports for your applications.
What we need from you
Three things, none of them a project.
Read access to the system of record, for the test environment
An API, a database view or a scheduled file export. Whatever the core system offers. Credentials are scoped to the test environment and never reach a preview.
One hour in week three
Somebody who knows the data confirms the mapping against a real test record. That is the integration review.
A named approver
Who in your organisation approves a promotion to production. It can be you, it can be the business owner. It is on record either way.
What you get
The parts of a software project IT usually inherits, already done.
No new legacy
The application is standard code, not a runtime you license. If Nuclicore disappeared tomorrow, any developer picks up the repository.
A change record you would have designed yourself
Every task has acceptance criteria and becomes one commit. The git log and the workspace audit trail together form the change record.
Separation of duties by construction
The agent that plans does not build, the agent that builds does not sign off, and a person approves the release. Auditors recognise the pattern.
Security you can verify, not take on trust
Static code analysis with Semgrep and dependency scanning with Trivy before every build. Critical and high findings stop the release, safe dependency upgrades are applied automatically and committed on their own, and nightly ZAP scans run against the running application. Export the repository and run your own scanners against the same code.
A defined integration boundary
The integration is a separate task with its own acceptance criteria. When your core system changes, the integration is re-pointed in test; the application does not move.
Your code in your own GitLab, continuously
Switch on repository backup and every successful release is pushed to your own GitLab: one branch per environment, one commit per release, one way only, no secrets included. That is the escrow answer without an escrow agent, and it means the exit path is already exercised rather than promised.
What you do not have to do
Build it
The business writes the brief, reads the task list and clicks through the preview. The agents build, test and release.
Run it
Hosting, backups, monitoring, updates and the security gate are the platform's job on managed hosting. On BYOC, it runs inside your existing controls.
Migrate it later
Own backend per application, managed Postgres per environment, standard stack, export at any time. Nothing to migrate off, nothing to re-platform.
Answer the questionnaire alone
The security pack exists. The sub-processor list is public. The security and compliance page is kept current.
What IT and security teams ask
Can our developers work on the code as well?
Yes. The repository is standard React and Node.js. Export it to GitHub, open pull requests, or let the agents continue inside it. Both at once is fine.
Which identity provider can we use?
Sign-in and role-based access are built in; SSO is available on Enterprise. Roles are scoped per application, environment and deployment label.
Do the AI models see our production data?
No. Tasks are built and tested in preview and test environments with their own databases and secrets. Production secrets are never placed in code or in prompts. Your workspace content is not used to train models.
What if the business asks for something that should not be built?
The task list is visible before any code exists, and you can be the approver for anything that touches your systems. Nothing reaches production without a named approval.
Bring the questionnaire. We answer it live.
Thirty minutes with the founder, with the security gate, the environments and the audit log on screen, on a real application.
Security and compliance