Identity boundary
Behind company login
Every app sits behind your company login. There are no public links.
For operations teams who build their own tools
Build with your coding agent.
Build with your coding agent.
Deploy on Delimitus.
Your agent writes the code. Delimitus handles deployment, infrastructure, security and company access, so you get a secure, shareable internal app in minutes, not weeks.
Private pilot. Not generally available yet.
Illustration · example data
- 1
Tell your agent what to build“Build this and deploy it on Delimitus.”
- 2
Your agent builds and deploysDelimitus handles infrastructure, security and company access.
- 3
Get a secure, shareable appReady for your team in minutes.
One prompt
“Deploy this on Delimitus.” The rest is ours. IT keeps the last word.
How it works
From prompt to production.
Ask your coding agent to deploy. Delimitus does the rest, and IT keeps the last word.
YouBuild an inbound dock scheduler from our Snowflake data and deploy it on Delimitus.
AgentBuilt dock-board, a Node app. Deploying it with Delimitus.
Delimitus
Node app built
No leaked keys found
Carrier API key kept as a secret
Company login on
Live in preview
Snowflake connection, read-only: waiting for IT
Share with Inbound team: waiting for IT
AgentDeployed to preview:
https://dock-board--preview.k4r7tq2m.delimitusapps.com
IT has two requests to approve: the Snowflake connection and sharing with Inbound team.
Prefer direct control? Deploy with ssc deploy from the app’s folder, or push to GitHub.
The gap
The prompt is simple. Everything behind it isn’t.
Between a tool that works and a link the night shift can open sits a list nobody on the floor signed up for.
What your team types
Deploy this on Delimitus.
What Delimitus handles
- A cloud account
- Company login
- HTTPS
- A database
- Secrets
- Network rules
- Leaked-key checks
- Timers
- Logs
- Who can open it
- Approvals
- Audit log
- Rollback
What your team gets
dock-board.k4r7tq2m.delimitusapps.comCompany login
So the tool stays on a laptop, or goes back to a spreadsheet. Delimitus is that list, done.
Example
One prompt and one approval later, the night shift is using it.
Dana runs inbound at a distribution centre. She built a dock board with Claude Code, then asked it to deploy.
- Dana to Claude Code
The dock board looks good. Deploy it on Delimitus and share it with Inbound and Night shift.
- Claude Code
Deployed. I’ve asked to share it with Inbound team and Night shift. IT approves that, not me.
- DanaPromoted it to production after a look in preview.
- IT approvedShared with Inbound team and Night shift.
Who’s looking?
Shared with two groups from the company directory, once IT approved. Everyone else is turned away.
dock-board.k4r7tq2m.delimitusapps.com
Company login
DOSigned in as Dana Ortiz, through Inbound team
Inbound dock board
Reno distribution centre · today
Trucks due today38
Unloaded2155% of today’s trucks
Running late4
| Door | Carrier | Booked | Status |
|---|---|---|---|
| D04 | Example Freight Co. | 06:30 | Unloading |
| D07 | Sample Linehaul | 07:15 | 40 min late |
| D11 | Demo Carriers | 08:00 | At the gate |
| D02 | Placeholder Haulage | 08:45 | Expected |
Showing 4 of 17 doors, earliest booking first.Shared with Inbound team, Night shift
Illustration · example data
Works with
One deployment target for every coding agent.
Your team builds wherever they like. When the tool needs to become a company app, their agent deploys it through Delimitus.
Delimitus isn’t another coding agent. It’s where coding agents deploy company software.
Deploys directly
- Claude Code
- Codex
- Cursor
The agent calls Delimitus from the editor.
Through GitHub
- Lovable
- Replit
Sync the project to GitHub. Each push deploys to preview.
Runs on
- Google Cloud
In the US, with each company in a cloud account of its own.
Sign in with
- Okta
Your people use the company login they already have.
Python and Node apps.
Product names belong to their owners. Delimitus is not affiliated with or endorsed by them.
What you get
One tool for the agent. A control plane for IT.
The people who build ask for what they need from the editor. IT sets the rules once and sees every app.
The agent gets
Deploy this on Delimitus.
- Deploy
- Preview, then production
- Ask to share it
- Logs
- A database for each app
- File storage
- Timers for scheduled jobs
- Roll back to an earlier release
Same rules whether the deployment came from a person or an agent.
IT gets
- Company login on every app
- A list of every app and who owns it
- Which company data each app reads, read-only
- Which internet hosts apps can reach
- Approvals before production
- An audit log of every change
- One switch that turns an app off
- Each company in a cloud account of its own
What operations teams ask their agents for
A dock scheduler the inbound team books trucks into.
Asked ofClaude Code
- Its own database for the bookings
- A timer that rolls the schedule over at midnight
- Shared with the Inbound team group
PilotAll of this is part of the private pilot offer.
Security
Agents move fast. Your policies still win.
Five boundaries hold for every app, whoever deployed it.
Data boundary
Only approved data
An app gets only the company data connections IT approved, and reads them read-only.
Network boundary
Only allowed hosts
Apps reach only the internet hosts IT allows, and never each other.
Secret boundary
No credential for the agent
The agent never needs the key. Secrets are stored for the app and never shown again, to people or agents.
Deployment boundary
Production on your terms
Production can require an approval, and an agent can never approve a request.
Giving an agent permission to deploy doesn’t give it permission to get around IT.
Cost
The expensive part isn’t running the app.
It’s everything around it.
Build
Minutes to hours, with a coding agent.
Deploy it yourself
A cloud account, company login, a database, secrets, an IT review and upkeep.
$32,658First year, 10 apps, at list prices and IT time
Deploy with Delimitus
One request from the agent. IT approves what matters.
Pricing is agreed with each pilot
See the full cost model
| Item | Do it yourself | With Delimitus, we take over |
|---|---|---|
| Cloud bill, list prices | $2,738 | The cloud account and everything in it |
| IT setup, one time | $5,440 | Company login, secrets and the database |
| IT time to put each app live | $8,160 | The deploy; your IT approves |
| IT upkeep, 12 months | $16,320 | Keeping it running |
| Total | $32,658 | Pricing is agreed with each pilot |
Defaults: 10 apps, $68 an hour, 80 hours of setup, 12 hours per app, 2 hours of upkeep per app a month. The hours are our estimate; change them.
Where the numbers come from
Cloud: Google Cloud list prices for us-central1, in US dollars, 730 hours a month, no free tiers and no discounts. A month costs $129.53 plus $9.86 for each app:
- HTTPS load balancer for company login, $18.25 ($0.025 an hour). Cloud Load Balancing pricing, fetched 2026-10-07.
- Managed Postgres, smallest high-availability tier with point-in-time recovery, $102.02. Cloud SQL price list, fetched 2026-10-07.
- A fixed outbound IP address, $4.67. Cloud NAT price list, fetched 2026-10-07.
- Logs, 5 GB a month, $2.50. Secret store, 20 secrets, $1.23. Builds, 60 minutes, $0.36. Image registry, 5 GB, $0.50. Price lists fetched 2026-10-07.
- Each app: one instance kept warm so the first visit is not slow (minimum instances 1; 1 vCPU, 512 MiB), $9.86: $6.57 for CPU and $3.29 for memory. Cloud Run pricing (cloud.google.com/run/pricing), idle minimum-instance rate, fetched 2026-10-07.
IT rate: $47.66 an hour, the median pay of network and computer systems administrators (US Bureau of Labor Statistics, 2025), times 1.43 for benefits, because wages are 70.0% of what private employers pay per hour worked (BLS Employer Costs for Employee Compensation, June 2026). That is $68.15; the default rounds it to $68.
Hours, our estimate: 80 to set up the cloud account, network, company login, build pipeline, logs and a security review; 12 to put each app live; 2 a month per app for updates, access changes and fixes.
Pilot boundaries
Opinionated on purpose.
We’re starting with the safest, most common shape of internal software.
- No public appsEvery request needs a company login.
- No custom domainsApps live at an address on our domain.
- No inbound webhooksOutside services can’t call into your app.
- Company data is read-onlyApps read your company databases and never write to them.
Questions
What does it cost?
Pricing is agreed with each pilot. The cost section shows what doing it yourself costs.
Is Delimitus a coding agent?
No. Delimitus isn’t another coding agent. It’s where coding agents deploy company software.
Which tools can I build with?
Claude Code, Codex and Cursor deploy directly: the agent calls Delimitus from the editor. Lovable and Replit apps deploy through GitHub. Python and Node apps.
Can an agent get around IT?
No. An agent can deploy to preview and ask for access or data. Only an admin can approve, and an agent can never approve a request.
Where does it run?
On Google Cloud in the US, with each company in a cloud account of its own.
Who can open my app?
Only people signed in with your company login, and only the ones you shared it with: a person, a group, or the whole company.
Can an app be public?
No. Every request needs a company login.
What happens to my code and data?
Your app runs in your company’s own cloud account. It reads company databases read-only and reaches the internet only where IT allowed it. Secrets are never shown again, to people or to coding agents.
How do I get in?
Delimitus is in private pilot. Request a pilot below.
Private pilot
Have your agent deploy one real app.
Bring an internal tool you’ve already built with Claude Code, Codex, Cursor, Lovable or Replit. We’ll connect Delimitus and get it behind your company login during the pilot.
Delimitus is not generally available yet. Tell us who you are and we’ll reply by email.
Thanks. We have your request.
We’ll reply by email.
Your next promptDeploy this on Delimitus.