Is it safe to let staff ship tools they built with AI?
It can be, when their tools run somewhere your admins control, not on laptops or the open web. On Patchy Cloud, admins control who joins and what data is connected and can roll back any tool, but any member can publish their own tools without approval, there’s no company single sign-on yet, and the beta terms rule out sensitive data such as health records and card numbers.
Before you start
Some data can’t go in at all. Patchy Cloud holds no security or compliance certifications, such as SOC 2, HIPAA or PCI DSS. So the beta terms rule out health information covered by HIPAA, card or bank account numbers, government ID numbers, personal information about children, personal data covered by the GDPR or UK GDPR, and data a law or contract says must be kept on certified or audited systems. That includes data a tool reads from a connected database, not only what people upload.
Sign-in is an emailed code. People sign in with a code sent to their email, with no passwords. There’s no company single sign-on yet, through a system like Okta, so you can’t require everyone to sign in through your identity provider.
It’s a beta. The terms make no promise about uptime, and say Patchy Cloud may lose data. Keep your own copy of anything you can’t afford to lose.
What you need
- An invitation to Patchy Cloud. It’s in beta: join the waitlist with your work email. If your company is already in, ask an admin to invite you.
- Someone to be the first admin. The first person from your company to sign in names it and becomes its admin.
- For company data, a database login that can only read what tools need. See the company data guide.
- Chrome, or another Chromium browser such as Edge, on a computer, for you and your coworkers. Phones, Safari and Firefox aren’t supported.
- A company based in the US. The beta is for US companies.
Steps
Be the first in, and add a second admin
Sign in from your invitation and name your company; you become its admin. Invite staff from the People page, and make at least one more person an admin. Only people an admin invites can join, and a company always keeps one active admin.
Tell staff what stays out
Keeping that data out is up to your company, so tell staff what must stay out, starting with the beta terms’ list above. Remind them that everyone who can open a tool can see what it saves.
Connect company data yourself
Only admins connect company data, such as a Postgres database or a company email address on Pidgeon. Tools can only read it, unless an admin lets them send from an email address. Tools reach it through Patchy Cloud and never see the password or key. The source sees one login for everyone, so connect a database with a login that can only read what tools need.
Let staff build and publish
Every member can build and publish, and there’s no approval step before a tool goes live. Each publish is a new version, recorded with who published it. Only a tool’s owner can publish to it, and Patchy Cloud refuses a new version from anyone else’s agent.
Keep an eye on what’s live
As an admin you see every tool in your company, and each tool’s page shows its owner. You can roll a tool back to an earlier version, make a public one company-only again, retire it or hand it to someone else. Each connection’s page lists its latest calls: when, from which tool and for whom.
When someone leaves, deactivate them
Deactivating a person ends their access to your company, signs out every computer their agents used and disconnects every agent they connected. Their tools keep running until you retire them or hand them to someone else; you can retire them as you deactivate.
Who can open it
- Yes
Coworkers signed in to your company
All of them, with nothing extra to set up.
- No
People outside your company
They can’t open it. Anyone signed out is asked to sign in.
- Not yet
Only some coworkers, like one team
A company tool opens for everyone in the company.
- If you choose
Anyone with the link
Only if you make it public, which works for pages and simple tools. A public tool can’t save data or read company data, and tools that run code on Patchy’s servers can’t be public.
Questions
Can we require our identity provider, like Okta?
Not yet. People sign in with a code sent to their email, and there’s no company single sign-on yet.
Is Patchy Cloud SOC 2 certified?
No. It holds no security or compliance certifications, so the beta terms rule out data a law or contract says must be kept on certified or audited systems.
Where is our data kept?
In databases and file storage in the United States. The privacy notice lists the vendors Patchy relies on, what each one handles and where.
Do you train AI models on our data?
No. The beta terms say Patchy doesn’t use your company’s content to train models, and doesn’t sell it.
Can Patchy’s team see our data?
The team can reach the servers to run them. Apart from reading tools’ names and descriptions, it opens your company’s content only to fix a problem you raised, to keep the service secure and running, or where the law requires.
Can we get our data out if we leave?
Yes. If an admin asks before your company closes, or within 14 days after, Patchy exports your tables and files by hand and sends them to that admin.