Your people build.You keep the keys.
Connect a system once. Review what goes live.
ISO 27001. EU/EEA processing. Google or Microsoft work sign-in.
You approved none of this.
It is already running. Here is what changes.
“CC + Railway works until someone pastes a prod key into an env var.”
Founder, Hacker News, July 2026
You connect the system once. Nobody else ever holds the credential.
“They’re deploying them on their personal Vercel accounts and sending the url over Slack.”
Founder interviewing builders, Hacker News, July 2026
One address inside the company. Signed-in members only.
Only 5 percent of technology leaders are confident they can see what runs in production.
Retool survey of 307 CTOs, CIOs and CISOs, June 2026
One list. Every app, every run, every publish, with a person against it.
What changes
Where it runs
A laptop, or a personal hosting account.
A link only signed-in members of your organization can open. There is no public link.
How it reaches data
A key pasted into an env var.
Tables, not keys. The ones you granted. The credential is never displayed, to anyone.
Who sees what goes live
Nobody, until it breaks.
You, before it reaches the team. And the log keeps every publish after.
Their own workspace
A workspace someone creates with a work email is their own organization: they are its admin, it holds only the files they upload, and it has no connection to your systems.
Your company workspace is separate. The same app folder deploys to both, so nothing built alone is lost when it moves under your review.
Whether you can see, claim or delete a workspace on your verified domain, and whether the company DPA covers it: not yet written down anywhere. Ask us and we answer in writing.
ISO 27001 certified. EU/EEA processing by default.
What it connects to
If it has an API or a database, it connects. No waiting for a connector to be built.
and anything else behind an API.
Companies that run their data on Ronja, the platform underneath.
Before colleagues can use it: 12 things an internal app built with AI needs
ISO 27001 control 8.25 and NIS2 Article 21(2)(e) ask the same thing: code that runs for colleagues must be version-controlled and separated from where it was built. A laptop is neither.
Use it as your checklist, for Ronja or for anything else. Each line says what Ronja does today and where it is roadmap.
- It has an address inside the company, not on a laptop or a personal account.TodayApps publish to a stable link only signed-in members of your organization can open. There is no public link.
- Colleagues sign in; nobody shares a link the whole internet can open.Today, partlySign-in with a Google or Microsoft work account, and auto-join from your verified company domain. Sign-in through your own company directory (Entra ID, Google Workspace) is roadmap.
- It never holds a key. The company connects a system once, with scopes; the app uses it.TodaySecrets are never displayed, allowed hosts per secret, credentials injected server-side at run time. Apps read landed tables; a write to a source system can only go against the hosts the secret allows, and every call is logged.
- It says what it can touch, in a file, before it runs.TodayAn app declares its tables, secrets and capabilities in ronja.json; it can only be granted what the builder could already reach.
- It runs when the laptop is closed, on a schedule if it should, and tells someone when it fails.TodaySchedule (hourly at most), webhook, email, table and event triggers; failure alerts on by default.
- Every run and every action is logged with who and how, including when the who was an agent.TodayOrganization-wide audit log with agent and token chips; run traces kept about a year. It does not record who opened an app: every viewer gets the same powers.
- Every publish is a version you can go back to, and nothing is deleted silently.TodayVersion history, 30-day trash, named conflicts instead of overwrites.
- Someone other than the builder approves what reaches the team.TodayProposals from non-admins are reviewed by an admin; nobody approves their own proposal. Admins publish directly and the log records it.
- Numbers that come from company data are computed, not written by the model.TodayRonja never lets the model author a number; lineage from every figure to its source table.
- It outlives its builder.TodayApps live in folders owned by the organization. When you remove the builder from the workspace their token stops the same minute, and tokens expire after 90 days regardless. Admins can move and restore what they left. Removing people automatically from your directory is roadmap.
- There is an off switch a script cannot press.TodayRemoving a person, changing a role, purging data and deleting the workspace need a signed-in admin. No automated caller can do them, and nothing an automated caller does to Ronja’s own resources is unrecoverable: everything goes to a 30-day trash. Writes to outside systems, if you allow them, are yours to scope with allowed hosts.
- The builder’s coding agent sees only what the builder may see, and its provider is your contract, not ours.Today, partlyThe coding agent sees only the tables the builder can already reach, never a credential and never the source system. What the agent sends to its own model provider is governed by your Claude, ChatGPT or Cursor agreement, not by Ronja.
Missing a line? Tell us and we will add it, with an honest status.
What you actually do
- Step 1, one sign-up
Create the workspace
Sign up at cloud.ronja.tech with your Google or Microsoft work account. If your tenant blocks user consent, approve the Ronja app in Entra once; colleagues then sign in. Register your company domain so colleagues join at the role you choose, and decide which roles may share what they build. You remove people by hand until directory sync ships.
- Step 2, one admin session
Connect one system
Pick the ERP, CRM or database. Choose the tables that should land. Set the refresh cadence, hourly at most. The credential goes into a secret nobody can read back. Tables in shared folders are visible across the organization unless you narrow the default, so narrow which roles or groups can see a folder before you connect anything sensitive.
- Step 3, no time from you
Let people build in private
Builders push from Claude Code into their own private folder. Nothing they do is visible to colleagues until they ask to share it and you approve; admins can open anything at any time.
- Step 4, one look per proposal
Review, approve, watch the log
Proposals arrive with the app, the tables it reads and a preview. Approve, and the whole company can open it. The audit log shows every publish, run and admin action from then on. It does not record who opened an app; every viewer gets the same powers.
The three questions you will ask
Why not Power Apps?
If you live in Dataverse, every builder is inside your Microsoft tenant, and an admin has enabled code apps, use Power Apps. If your data lives in Monitor, Fortnox, HubSpot and a Postgres, and your people build from Claude Code, Ronja is the shorter road. You get a landed, modeled data layer with lineage instead of 1,500 connectors.
Why not Retool?
If you want Retool’s builder and you are on Enterprise, use Retool. Retool imports a React app, holds the credential and proxies the live call. Ronja lands the table, models it, logs every action and lets you walk every number back. The schedule, the email and the approval step run here too. Review, the audit log and EU processing are on the self-serve plan.
We already have Claude Enterprise or ChatGPT Enterprise. Why this?
Keep them. They give your people a model behind your company sign-in. They do not give what your people build a place to run, and no governed path to the ERP. Ronja is the computer those apps run on. Your Claude Enterprise or ChatGPT Enterprise agreement covers the builder’s transcript; Ronja covers what runs.
The paperwork
The data processing agreement and the terms are published. Anything else a review asks for, ask us and we send it.
What it costs
- Per workspace
- $50 a month
- Everyone in it
- No seat count
- To start
- 100 free credits
- After that
- $1 a credit
Credits cover the building and the running. Opening a published app costs nothing.
Review before publish, versions, the audit log, EU/EEA processing and the data processing agreement are on this plan. There is no enterprise tier above it.
Start with one system and one team.
Create the workspace, connect one source, choose one role that may share what it builds. The first app is usually the report someone already makes by hand every Monday.