Workflows are event-driven: a trigger fires and steps run across connected systems without manual handoff. Steps execute in sequence or in parallel; branching logic and retry handling are managed by the platform. At any designated point, the workflow pauses for a human decision — an approval, a review, a confirmation — then resumes from exactly where it stopped.

Without on.it, authentication has to be wired separately into every application, workflow engine, and agent you deploy — identity providers, session management, SSO federation, role enforcement, all of it, for each one. On on.it, none of that is your concern. One gateway handles authentication for everything you run on the platform, before a request ever reaches your code.

Data isolation

Data isolation enforced below your application code

Your application code literally cannot see another tenant's data — even if it tries.

In most systems, isolation is enforced by the application: every request carries a filter, every endpoint scopes its results. When one of those checks fails — a bug, a library update, an edge case — data from another scope appears where it shouldn't. The system had no structural mechanism to prevent it.

We took a different approach. Each scope's data is completely separated at the foundation of the platform. The application never has access to data outside its scope — not because the code checks for it, but because from the platform's perspective, that data simply isn't there. Isolation is not a filter the application applies; it is a structural property of the platform. This holds regardless of what the application does. A missing filter, an elevated permission, or a misconfigured integration cannot produce data from a different scope.

Observability

The audit trail cannot be touched by application code

Every action is recorded in a log your application cannot reach, modify, or backfill.

Telemetry is collected at the infrastructure layer — by the platform, before and after your application code runs. Every request is traced from the entry point to the data layer. The audit trail is captured through a pipeline that application processes cannot reach or modify — every event is recorded regardless of what the application emits, searchable and replayable from a single structured log. The telemetry pipeline is write-closed to application processes: the audit trail is complete, unmodifiable, and backfill-proof.

Most platforms offer a single extension point — usually a scripting layer or a configuration hook on top of a fixed core. on.it's plugin model runs through every layer of the stack: the data model, the business logic, and the AI layer all follow the same pattern and the same conventions. You can extend any level independently, without touching the others.

Analytics

Analytics without moving data

Query your live database and your historical data together — in one SQL statement, without replication.

A federated query layer sits over your existing data sources — object storage, operational databases, external systems — reading data in place. Historical and live data are queryable together in one SQL statement; the layer is read-only and your sources remain unchanged. Dashboards live inside the platform and inherit the same scope enforcement: each user sees only what their role permits.

Contextual AI

AI at the data layer

AI agents that read the same data your application reads — no more, no less — bounded by the same isolation rules.

AI agents connect directly to the data layer. When an agent runs, it reads structured records, event history, and real-time signals from the same sources the application uses — at query time, against live state. Scope is structural: what an agent can read is determined by the same isolation rules that govern every other request on the platform. An agent reads what the application reads — no more, no less.