Architecture
A loopback-only origin is published through Cloudflare Tunnel. The workspace requires an authenticated, CSRF-protected session and uses server-side validation for every write.
DOCUMENTATION
Local-first project management with explicit boundaries.
QuixPPM keeps project data in SQLite on the owner’s hardware. The public website and demo do not provide access to the private workspace.
Agent bridge
Agent actions use a separate revocable bridge credential. Browser sessions and bridge credentials are intentionally independent so either can be revoked without affecting the other.
Data and backups
Projects, tasks, milestones, collaborators, budgets, and activity records are stored locally. Automated backups preserve the database and generated workspaces.
Deployment model
The current deployment is a private owner instance. A hosted multi-tenant service would require separate tenant isolation, RBAC, billing, and Postgres infrastructure.