Defence Self-hosted
Agent infrastructure that meets the highest assurance bar.
An agent harness for defence and regulated environments — architected to support deployment in environments handling information classified up to Departementaal Vertrouwelijk (the Dutch government's TBB-4 level).
Self-hosted. Source-available. Deployable inside your air-gap. EpicStaff connects out only to the providers you configure keys for. Tools do what you tell them: a tool you build or enable that reaches the internet is your choice and your configuration.
Trusted in NATO defence sector.
What working with us looks like
We work directly with the teams that run the platform.
No resellers, no managed-cloud middleman, no integration-partner layer between us and the engineers who deploy.
The platform partnership
EpicStaff powers the agent layer inside Epicflow, the planning platform used by defence and aerospace primes. If you already run Epicflow, the agent infrastructure underneath is EpicStaff — a separate product on the same source-available code.
Compliance and control
Compliance and control mapping is produced alongside a concrete deployment. The shape tracks whichever Defensie, NATO, or sector-specific framework you choose to evaluate against. We work with what your governance team already runs. We don't ship a "compliance checklist" before we know what you're evaluating against. We'd rather earn the answer in your specific environment than promise it in the abstract.
Architecture, briefly
EpicStaff is deployed on containers. Kubernetes is supported if required. It runs fully air-gapped. Nothing phones home; nothing requires an internet connection at runtime. The model adapter is the only outbound boundary — the only component talking to your LLM endpoint. Swapping models is configuration, not code. Knowledge base, audit trail, and the RBAC layer are EpicStaff-internal and survive any LLM change.
Multi-tenancy and updates
EpicStaff models organisations as first-class objects, so multiple units sharing one instance is a supported pattern. Per-tenant access boundaries are enforced through the RBAC layer. Updates are versioned container images. You pull on your own cadence. Rollback is "redeploy the previous image tag." No in-place upgrades that require runtime trust.
Commercial framing
Source-available code. The company that supports EpicStaff is HYS Enterprise — Dutch, KvK 32130233. Commercial terms are conversation-led, not list-priced. The evaluation phase — typically eight to twelve weeks — carries no licence fee. Production support and SLA are a separate conversation once you have a real use-case.
Defence
What's in the Defence tier
DEDICATED DEPLOYMENT ENGINEERING
the people who built it deploy it with you.
SOVEREIGN DEPLOYMENT POSTURE
air-gap-capable, on-prem. signed container images you pull on your own cadence. no telemetry, no phone-home, no analytics.
CLASSIFICATION-HANDLING HOOKS
EpicStaff treats documents and prompts as opaque bytes. your classification policy layers on top: metadata fields, role-scoped retrieval gates, audit annotations.
SOURCE-AVAILABLE CODE
your engineers can read and audit every line that touches data.
IDENTITY INTEGRATION
LDAP, OIDC, SAML. your principals authenticate against your existing identity infrastructure.
A COMPLETE AUDIT TRAIL
every prompt, tool call, and model response, attributed to a named principal. stored in PostgreSQL, exportable, retention is your call.
SOVEREIGN PARTNER
where the operating environment requires it.
COMMERCIAL FRAMING
Conversation-led. Not list-priced.
- EVALUATION PHASE
- No licence fee.Scope agreed with you up front. Production licence + SLA is a separate conversation once a real use-case is in flight.
- VENDOR-OF-RECORD
- HYS EnterpriseDutch · KvK 32130233
LET'S TALK