An introduction to Demystify OS
Premiere soon
Playback will be added after episode approval. No video is loaded.
Demystify Business OS Guide
Understand the controls and their limits
Understand the work, choose your controls, and see what comes next.
Early access
Demystify OS uses row-level security and encrypted storage for customer records held in India. Governance is designed to put a person on consequential actions. Designed with ISO 27001 and SOC II in mind. Not certified. Audit readiness is planned for Q1 2027, and model-call residency remains under review.
Updated 4 November 2026. Early access: invite-only beta since 1 November 2026.
Security: the approach, step by step
Protect the records
Customer records are held in India with row-level security and encrypted storage. This does not establish the residency of every model call.
Review consequential actions
The R0 to R3 approval ladder is designed to match oversight to risk. Confirm the controls in your deployment.
Make evidence inspectable
An append-only activity log exists today. Hash-chained proof and signed proof packs are building now; a kill-switch drill is pending.
Read the diagram as a list
- Protect the records: Customer records are held in India with row-level security and encrypted storage. This does not establish the residency of every model call.
- Review consequential actions: The R0 to R3 approval ladder is designed to match oversight to risk. Confirm the controls in your deployment.
- Make evidence inspectable: An append-only activity log exists today. Hash-chained proof and signed proof packs are building now; a kill-switch drill is pending.
Protect the records
Customer records are held in India with row-level security and encrypted storage. This does not establish the residency of every model call.Review consequential actions
The R0 to R3 approval ladder is designed to match oversight to risk. Confirm the controls in your deployment.Make evidence inspectable
An append-only activity log exists today. Hash-chained proof and signed proof packs are building now; a kill-switch drill is pending.
How do I join?
Apply for the invite-only beta. A person reads every application. The beta began on 1 November 2026.
When is Community planned?
Public launch and the Community edition are targeted for 1 January 2027. Plans change; dates are targets, not promises.
Is Demystify OS certified?
Designed with ISO 27001 and SOC II in mind. Not certified. Audit readiness is planned for Q1 2027.
What does aligned mean?
GDPR, DPDP and CCPA aligned describes the design approach. It describes how the product is designed. It is not an audit result and not a guarantee. Read the security page for the current posture and shared responsibilities.
What must stay out of voice?
Mysty must never collect Aadhaar, bank details, card details or OTPs by voice.
Identity, worker access and support
Review identity, role enforcement, worker tool scopes and customer-approved support access for your deployment. Proposed single sign-on, stronger organisational controls and time-limited support access must not be read as universally enabled features.
Audit readiness
Designed with ISO 27001 and SOC II in mind. Not certified. Audit readiness is planned for Q1 2027. Independent auditors and security testers perform their own work; software does not issue their opinion.
Policies, controls and the limits of a kit
A readiness programme can organise policies, control owners, risk and vendor registers, evidence, access reviews and management review. These are programme activities and planned Assure scope, not a promise of independent attestation. Auditor fees and independent testing are separately scoped.
Licence, intellectual property and brand
Confirm the current licence, data-processing terms, permitted use and support agreement for your edition. Community is targeted for 1 January 2027. The old guide's legal budgets, trademark plans, escrow and offline licence mechanics are not contractual commitments.
The Assure proof pack
The planned output is a verifiable bundle for an agreed framework and period, with a source and time for each claim. Signed proof packs are building now, targeted with Assure for end December 2026. They do not establish independent attestation.
Private deployment and shared responsibility
Agree the application, storage, model endpoints, identity, support access and upgrade path in the deployment scope. Your organisation and the service provider must understand their data-processing responsibilities. A Private label alone does not prove model residency, air-gap support, recovery guarantees or a contractual liability cap.
Demystify OS: Inception to Reality
Business work with human approval
Premiere soon
Playback will be added after episode approval. No video is loaded.
Next steps
Start with the task you want help with
Early access
Invite-only beta since 1 November 2026
Apply for the beta. A person reads every application and discusses the fit before an invitation. Share a short task description, without credentials or customer records.
Apply for the beta
Apply for the Demystify OS beta
After submitting, check your inbox for the confirmation link. Your application is reviewed once confirmed.