Sign-in.
Two-factor authentication is required for every operator, sessions last 12 hours, "Sign out everywhere" ends them all, and each operator holds a scope: read, support or admin.
RUN · HOW WE RUN PRAXIS
How we run your sites.
Every site has its own database. We check its health every hour, back it up twice a day, and open an incident when something fails. When our team reaches your site, it is on your record.
Every figure on this page is as of October 2026.
What we do
A database for every site
- Each site gets a database of its own when it is created: either its own database on a shared Neon instance, or a Neon project of its own. Its content, its events and its visitor facts live there, never in tables shared with another customer.
- On every request, the address picks the site and its database. An unknown or suspended address fails closed.
- Uploaded and migrated files are kept in Cloudflare's object storage, R2.
Health, every hour
- A sweep checks the health of every site every hour, and you see the result on your account's Sites tab.
- Every custom domain is watched, with a warning before its certificate expires.
- Each account's usage is metered against its plan's limits.
Backups, twice a day
- Every site's database is backed up twice a day.
- Before any restore, our operators take a fresh backup first, so a restore never destroys today's only copy.
- Restoring a site is done by our operators, on request.
- You can restore your site from a verified backup yourself. Coming soon.
- A site's staging copy is made from a backup, and a card promotes it. Coming soon.
- Backups are kept for a period set by plan, and a live site always keeps its newest verified backup. Coming soon.
- Separately, each site's own Settings has EmDash's backups screen. Taking or downloading a backup from it is not available yet.
Incidents
- When a workflow fails, the system opens an incident by itself. Our operators open, page and resolve incidents.
- A public status page shows what the hourly health sweep finds and every open incident. Coming soon.
- Support, in our own words: "Email support@amadalis.ai. We aim to reply within one business day; at busy times it can take an extra day. Testers come first: we always give them priority so that they are unblocked."
The audit trail
- Our operators' actions are written to a tamper-evident audit log in which each entry is linked by a SHA-256 hash to the one before it. Editing or deleting an earlier entry breaks the chain, and the platform checks the whole log every night.
- Your account's own Security log is chained in the same way, and you can download it.
- The copilot records every step of every action it takes, from a refusal or a dry run to approval, execution, rejection, rollback or error, with a line in plain words.
Support access, always on your record
Four ways our support can reach your site, as your account's Security tab states them.
| Way | When | What it allows | Where it is recorded |
|---|---|---|---|
| A grant you give | You create it for a purpose you state, and you can revoke it at any time | Reaching your site | Your Security log |
| Read-only support reads | While a grant is active | Looking, never changing | Your Security log |
| Break-glass | In an incident, without a grant, with a stated reason | Read-only, marked "BREAK-GLASS" in your list of grants | Your Security log |
| An explicit admin override | Only after a confirmation and a reason | Entry with Admin rights | Your Security log, with the reason beside it |
Our operators also need a recorded reason to open a customer’s admin at all. Support entries into every site of your account appear in your Security log while you are an owner or Admin of an active or suspended site in the account; otherwise the log shows only the site your account opens with. A fully erased site’s entries no longer appear. "Support access" on your Security tab lists the live grants on the same sites as your log, and you can revoke any of them; you can give a grant only for an active or suspended site you are an owner or Admin of, and it covers that site alone.
Lifecycle
- Suspending a site, and reactivating it, each need a written reason, and a suspension can be scheduled for a later date.
- Closing an account. A termination ends with a deletion certificate that documents what was destroyed. The final deletion is a separate job run by our operators, and the account's entry in our registry survives as a tombstone, so the record of what happened is kept.
- You can close the account yourself, and the closure ends with the same deletion certificate. Coming soon.
AI governance
- Every copilot call goes through Cloudflare's AI Gateway, authenticated, with payload logging switched off, so only the call's metadata is logged.
- Which model runs is our configuration; customers whose plan includes the choice pick a tier.
- Copilot calls are written to a cost ledger, and the account's monthly AI allowance is checked on every call.
- With a customer's own provider keys switched on, every call uses their key or is refused, never quietly sent on ours.
- We hold a switch that turns AI off for a customer, and controls that restrict it during an incident; usage is checked against Cloudflare's own records.
Our own team, under the same rules
The same governed copilot.
Our operators' copilot works through the same gateway as yours, and every change it proposes stops at an approval card that names the customer.
People decide the final step.
The final termination of an account stays with a person; no AI can perform it.
Two separate addresses.
Your account lives at account.amadalis.ai, which answers only a closed list of customer pages; our console is never reachable there.
Subprocessors
- We keep a public register of the third-party processors the platform uses: what each one does, and where it runs.
- It is kept current, for data processing agreements.
How it works
The rhythm of every site.
-
On every request.
The address picks the site and its own database; an unknown or suspended address fails closed.
-
Every hour.
The health sweep, the purge of data past its retention date, and any scheduled actions, such as a suspension set for a later date.
-
Twice a day.
A backup of every site's database.
-
When something fails.
An incident opens by itself, and an operator picks it up.
What keeps it safe
Separation.
A database for every site; a separate address for your account and for our console.
A record of every touch.
Four ways in for our support, each one recorded.
Reasons, not just rights.
Suspension, reactivation, break-glass and admin overrides each need a stated reason.
A copy first.
A fresh backup before any restore, and raw events deleted by a retention rule only after an archive export covers them.
Sealed secrets.
Stripe keys and identity provider secrets are stored encrypted, SCIM tokens only as a hash, and no copilot tool takes a secret.
People approve.
Our own copilot asks before every change and names the customer; the final termination of an account stays with a person.
Common questions
Can your staff see my site?
Only in the four ways your Security tab describes, and each one is recorded.
What support can I expect?
"We aim to reply within one business day; at busy times it can take an extra day. Testers come first: we always give them priority so that they are unblocked." Write to support@amadalis.ai.
Can I take a full copy of my site?
Your site's Settings can export the whole site as an archive, and Privacy & Data › Exports takes out your event data in a form a warehouse reads. Scheduled exports are available on request.
What happens when I leave?
Ask us to close the account. A termination ends with a deletion certificate that documents what was destroyed. You can also close the account yourself, with the same certificate. Coming soon.
Where do you run?
Every request arrives on Cloudflare's network, and your site's database runs in the region your account's Overview names.
Who are your subprocessors?
Our public register lists each one, what it does and where it runs.