Deployment
Runs in your boundary
BLC runs inside your own AWS account and signs users in with your identity provider.
Delivered through the AWS Marketplace
BLC is built to be delivered through the AWS Marketplace as container images. They run on Amazon ECS with AWS Fargate in your own AWS account. BLC ships as containers, not as a machine image, and does not require Kubernetes.
Each customer runs their own single-tenant instance.
Where the state lives
- Plain PostgreSQL on Amazon RDS or Aurora holds the data.
- Amazon S3 holds attachments, packages and backups.
- AWS Secrets Manager supplies secrets, so they are never written into configuration files.
Your identity provider
Sign-in uses OpenID Connect (OIDC) with the identity provider you choose. Roles come from group membership that your administrators grant.
Built for a strict boundary
- The web interface is designed to load nothing from the internet at runtime: no CDNs, no outside fonts, and a strict content security policy.
- Each container image gets a scan and a software bill of materials (SBOM).
- Configuration changes to an instance go through pull requests in the instance's own repository, so they leave a change record.
An assistant that helps, never decides
BLC's core functions are deterministic automation: code, scheduled checkers and scans. They are not produced by a language model.
PlannedAn optional in-app assistant drafts and suggests.
- It acts with the same permissions and approvals as a person, and it never signs anything.
- You set how far it reaches: observe, suggest, or stage for approval.
- You choose the models used in your installation.
People approve and sign. Risk acceptance is always a named person's decision.