Product
Connect, run, and manage, all inside the closed network
Kitewell runs inside networks that cannot reach the internet, on in-house servers and an in-house AI model. It needs no outbound connection. License activation, updates, workflow version control and rollout, and monitoring all happen inside the closed network.
01Setup
No line leads out
Kitewell, the in-house AI model, and the management platform all sit inside the closed network. What starts the work, and where the results go, are inside it too.
Closed networkConnections to the internet: none
Starts
- ScheduleNightly, month-end close
- Internal mail, shared foldersWhen orders or files arrive
- In-house systems, EAICalled by webhook or REST API
In-house servers and systems
- KitewellOn Windows Server or a VM, unattended
- In-house AI modelAn OpenAI-compatible model server
- Management platform (on-premises)Monitoring, rollout, audit log
- Core and business systemsThrough API, files, database, or screen
Results
- Shared folders, reportsResult files and ledgers
- Internal mail, chatResults, and what needs checking
- The calling systemResults returned over HTTP
02Connections
What each feature connects to, and how a closed network handles it
Features that reach outside in the standard setup are either kept in-house or not used in a closed-network setup.
| Feature | Standard setup | Closed network |
|---|---|---|
| AI model | Sent to the AI provider you chose | Sent only to your in-house model server |
| Assistant (builds and fixes in plain words) | Runs on the AI model you chose | Runs on your in-house model |
| License activation | Activated through the Kitewell account | Activated with no internet connection |
| Updates | Arrive automatically from kitewell.com | Versions you have tested, carried in and applied |
| Management and sync | Cloud edition run by Descarty | Management platform, on-premises edition, inside the closed network |
| Notifications | Email, Slack, Microsoft Teams | Your internal mail server and internal chat |
| Calls from outside | ChatGPT, Claude, and webhooks go through Descarty's relay | Not used. In-house systems call Kitewell directly by REST API or webhook |
| Web search | Goes through Descarty's service | Not used |
03Bringing it in and updating
Carried in, tested, then updated
In a closed network, you decide what goes in and when. Nothing changes until you apply it.
- Bringing it in
- Each installer is signed and comes with its SHA-256 hash, so you can check it before carrying it into the closed network.
- License
- Activates with no internet connection.
- Pinned versions
- Turn automatic updates off and run only versions you have tested.
- Updating
- Apply a version to production once it has passed in your test environment. A backup is taken before each update, and you can return to the previous version.
04Operations and management
Everything operations needs, all inside the closed network
The features that manage many computers together run as the management platform's on-premises edition, inside the closed network.
Manage change
- Version control
- Every change to a workflow is kept as a version, so you can compare versions and go back to an earlier one. Definitions are YAML files, so they can live in your own Git too.
- Rollout
- Keep development, test, and production apart, and promote workflows to production once they pass.
- Assignment
- Decide in one place which workflow runs on which computer.
- Robot ledger
- Export a ledger of every workflow to Excel, in the order of FISC's management items.
Watch it run
- Monitoring
- See every computer's status, runs, and failures in one place.
- Alerts
- Stopped computers and failed runs are reported to your internal mail or chat.
- Run records
- Logs, output, duration, and screenshots are kept for every step.
- Audit log
- Changes and runs across all computers are recorded, and can be exported and kept long term.
Protect and recover
- Permissions
- Set roles per project, and policies for which sites and apps may be operated.
- SSO and SCIM
- Sign in through your in-house identity provider (SAML), with staff added and removed automatically.
- API keys
- Set each key's projects, permissions, and expiry, and revoke keys one by one.
- Recovery
- Take regular backups and restore them, and resume runs from the step that failed.
05Requirements
Where it runs, and what it connects to
It runs on in-house servers or VMs and connects to the screens, files, databases, and APIs inside the closed network.
- Where Kitewell runs
- Windows Server 2019 or later, and 64-bit Windows 10 (version 1809 or later) or Windows 11. VMs on in-house virtualization, or in a cloud placed inside the closed network
- Unattended runs
- Runs with no one signed in
- AI model
- An in-house model server with an OpenAI-compatible API (vLLM, Ollama, and others)
- Screens it operates
- Web systems, Windows apps, terminal emulators, and screens reached through VDI, Citrix, or Remote Desktop
- Connection methods
- API, files (shared folders, SFTP), database reads, and screens
- Network segments
- It never bridges segments. Place Kitewell where it reaches both, or one in each network, joined by the hand-off method your rules allow
06Review materials
For IT and security reviews
Materials ready for an adoption review.
- Kitewell security overview (PDF)
- What is sent out and what is not, current limitations, and answers to the questions security checklists ask most.
- Robot ledger template (Excel)
- 15 items chosen from FISC's robot management items, with filled-in examples.
07How to start
Proven inside the closed network, then into production
- 01
Connection test
FreeSystems in a closed network are fine. With a screen recording and sample data, we confirm Kitewell can connect without entering your network.
- 02
PoC (one month)
¥500,000 (excl. tax)Run inside your closed network on the same screens and data as production, and check it against success criteria agreed in advance. If it falls short, there is no charge.
- 03
Production
Quoted for your setupCarry the tested version into production, and place unattended runs and the management platform to fit your setup.
Frequently asked questions
- Can it be installed without ever connecting to the internet?
- Yes. Carry in the signed installer and install it; the license activates with no internet connection too. After installation, nothing connects out.
- How are updates applied?
- Turn automatic updates off, and carry in and apply versions you have tested. You can confirm a version in the test environment before applying it to production, and return to the previous version from the backup taken before the update.
- Can an in-house model operate screens and relearn steps?
- Yes. For steps that operate screens, choose a model that can read them. Reading documents, making judgments, and the assistant run on the same in-house model server.
- Can it operate screens through VDI, Citrix, or Remote Desktop?
- Yes. Kitewell looks at the screen and operates it the way a person does, so it can operate systems inside VDI, Citrix, and Remote Desktop sessions.
- Can the management platform sit in the closed network too?
- Yes. Place the on-premises edition on your servers and use monitoring, rollout, the audit log, and SSO inside the closed network. Sync stays inside your environment too.
- Can it connect systems on separate network segments?
- It never makes traffic cross a network boundary. Place Kitewell where it reaches both, or one in each network, joined by the hand-off method you already allow. Where it goes follows your network rules.
A connection test on the systems inside your closed network
Tell us which systems to connect and what your network rules are. Even for closed-network systems, you can start from a screen recording and sample data.