Each control on this page links to the documentation or the administration surface that implements it. Where the responsibility is yours rather than ours, it says that too.
ShimoDocs runs inside your own Kubernetes cluster. Documents, metadata, permissions, version history and audit records are stored in your infrastructure, against your database and your object storage — there is no ShimoDocs tenancy holding a copy.
A single node is enough to evaluate the suite; production normally runs three or more control-plane nodes. Installation can run online, or from an offline image package on a network with no route to the internet.
Administration is a separate surface from the workspace. Tenants, users, licences, branding and AI configuration are managed in the operations platform, and those actions are recorded rather than being invisible.
The operation log is read-only by design: records cannot be created, edited or deleted from the product, including by an administrator. Each entry carries the event source, the operation type, the operating user, the object acted on and the timestamp.
AI is the part of a modern suite that usually means sending content to a vendor. Here the capabilities are endpoints you connect: a base model, an image model, embeddings, and optionally an online search service. Point them at a model inside your own boundary and the content stays there; point them at a provider you have approved and the data flow becomes a decision you made and can document.
Online search is a separate service and is not required. Left unconfigured, no outbound retrieval happens at all.
One network fact worth designing around rather than discovering: browsers read and write document content directly against the object storage endpoint, so that endpoint has to be reachable from the client network. Plan the path deliberately instead of exposing it by accident.
Backups belong to the operator, and the runbook says which databases, buckets and configuration to capture — and which directories to leave alone. Retention and hold are workspace policy decisions that the deployment can enforce, rather than promises a vendor makes about data it holds.
A private deployment splits responsibility, and a security review will ask which side each control sits on. The product ships the suite, the installer, the operations platform, the audit trail and the AI plumbing. Everything around it belongs to the operator:
These are the long-form answers we publish: what a private deployment changes for each framework, and what an auditor will ask you to evidence. They are written for the person answering the questionnaire, not to claim a badge.
No. The operation log is read-only in the product: records cannot be created, modified or deleted from it, and each entry carries the event source, operation type, operating user, the object acted on and the timestamp. That is what makes it usable as evidence rather than as a convenience feature.
Only to endpoints you configure. The AI capabilities — a base model, an image model, embeddings and an optional online search service — are connected in the operations platform, so a deployment can point them at a model inside its own network and keep content there. Online search is a separate, optional service: leave it unconfigured and no outbound retrieval happens.
In your own infrastructure: the suite runs in your Kubernetes cluster and writes to your database and your S3-compatible object storage. There is no ShimoDocs tenancy holding documents, metadata, permissions or audit records.
No, deliberately. Certification is a fact about a company and a defined scope, not something a product page should improvise. Ask the team for the current status and the evidence pack your review requires; what is documented here is the control itself, and where you can check it.