Every person gets their own process and their own encrypted database. Idle apps sleep into a bucket and wake in milliseconds. The whole system is one static binary you can run yourself: no control plane, no runtime, nothing that phones home.
🤖 This page was written by an LLM, on the ideas, instruction, and editing of humans. AI-written text here is always marked, visibly, like this. That's factor X.
Most software is used for a handful of them and billed for all of them. On CARLOS an app with no traffic has no process and no memory, because its database has left the box for object storage. The hours nobody used cost nothing.
11 / 168 HOURS USED · 157 NOT BILLEDSix outcomes, each with the mechanism that produces it. If a claim here has no machinery under it, it should not be on the page.
Conventional deployments buy capacity for the peak and pay for it around the clock. A CARLOS fleet is sized to concurrent use, not to how many accounts exist: idle tenants hibernate to a bucket, and a box carries as many sleeping tenants as it has disk to list them.
mechanism: hibernate to object storage · wake on the request that needs it · metered in cpu-core-hours, GB-hours and instance-hours, so the bill follows what actually ran
The cheapest watt is the one never drawn. Because an idle app runs no process at all (not a scaled-down container, not a warm pool, nothing), the energy floor under a CARLOS deployment is set by concurrent usage rather than by headcount. Fewer boxes for the same product is the whole of the mechanism, and it is measurable on your own bill.
mechanism: no process while idle · fleet sized to concurrent use · one static binary with no runtime to keep warm
This one is specific and testable rather than reassuring: publish the entire database and see what leaks. Built this way the answer is metadata (who talked to whom, and when) and never content. The residue is real and worth stating plainly; the point of the architecture is that it is all that is left.
mechanism: the server stores ciphertext plus key material it cannot open · private keys live in browsers and nowhere else
One person's process serves one person's data. A panic, a runaway query or a memory leak in someone's request path takes down their process; the next request starts it again, and nobody else notices. Underneath, routes carry several health-checked upstreams and box state snapshots to object storage every five minutes.
mechanism: blast radius of one · multi-upstream routes with in-request retry · five-minute snapshots · auto-recovery alarms on every instance
Centralised pieces are allowed (push relays, discovery, backup stores) on one condition: they must be glue. Thin, blind, replaceable. When the central piece falls to a subpoena, a seizure or a hack, the people inside lose some convenience and never a word they said.
mechanism: membership enforced by cryptography rather than a permission check · invite secrets ride in the URL fragment, which browsers never send to a server
Data residency stops being a contract clause and becomes a placement decision. The deployment is yours: your cloud account, your bucket, your regions. An app can be pinned to a region because the fleet is a list of boxes you own, and a workload is only ever placed on a host trusted enough to hold what it holds.
mechanism: one binary, a bucket and DNS is the entire dependency list · placement gated on declared trust class, not on capacity alone
Cost-efficient, Available, Replicated, Lightweight, Open, Secure. Six promises — and under each one, the attributes that actually achieve it.
Not running when nobody is using it. Most software is used a few hours a week and billed for a hundred and sixty-eight.
An instance with no traffic stops, and its database leaves the box for a bucket. What remains is a few objects, no process and no memory.
Nothing polls to keep an app alive. A sweep retires the idle; work still in flight when an instance winds down lands before it goes.
Sleeping tenants are entries in a list, not processes. Capacity is bought for the people using the product right now.
Usage is accrued per account in cpu-core-hours, GB-hours and instance-hours, and reconciled against the cloud bill — so the number you are charged names the machinery that produced it.
Always there when someone knocks. Availability is continuous even when execution isn't.
The caller does not get an error and does not get a cold-start page. The connection is held while the instance comes back, and then it is answered.
The edge round-robins across live upstreams and retries within the same request when one refuses a connection, so losing a box is not losing a route.
The registry — routes, instances, the shape of the deployment — is written to object storage on a timer, so a replacement box can be brought up from the bucket rather than from memory.
Auto-recovery alarms are armed on every box in the fleet, in each box's own region.
The box is disposable; the data is not. Losing a server costs a restart, not a history.
Replication is not a nightly job that might have run. It is continuous, and it starts when the database does.
An idle database leaves for the bucket under a single-writer lease where the lock and the manifest are the same object — so a takeover can never read a torn state.
The digest covers every column that describes a route, so a snapshot cannot silently drop the part of the deployment you would need on the way back up.
Because every wake from hibernation already pulls a database out of a bucket, the restore path is exercised continuously rather than rehearsed once a year.
The artifact is small because the rules make it hard to grow. Small enough that one person can read all of it.
Pure Go, no cgo, SQLite linked into the process, and nothing else to install alongside it: no container, no runtime, no bundler. Copy it to a box and run it.
Hand-written ES modules are served directly. What you read in the repository is what runs in the browser.
A hard line-count cap per module, checked by a test that fails the build. The cap only ever ratchets down.
Deploying new code over an old database is always safe, which is what makes a thousand independently-versioned instances tractable in the first place.
The dependency list is short enough to read in a sitting, and every entry on it had to argue its way in.
Open is not a licence badge. It is whether the person who depends on the software can actually run it, with no vendor in the loop.
There is no license server, no phone-home, and no essential component that exists only in somebody else's account. Nothing about running it yourself is a degraded mode.
Rastrillo, the Claude Code skill and the source of this site are public repositories you can read right now. The platform's own repository is not public yet. That is worth stating on the page that claims every other claim is checkable.
That is not a summary of the dependency list. That is the dependency list.
Handing someone the binary hands them the product, not a client for it.
Push relays, discovery and backup stores may exist on one condition: thin, blind and replaceable. When the central piece falls, the people inside lose convenience, never content.
Last in the acronym, first in the architecture. Every other letter is shaped around this one.
It stores opaque bytes plus key material wrapped to each member's public key. It never sees plaintext and never receives a usable private key.
There is no copy on the server to seize, subpoena or leak, because there was never a path by which one could arrive.
Access is decided by whether content was sealed to your key, not by a permission check somebody can forget to write.
A one-time secret after the # is never transmitted to the server by any browser, so an invite link is not a server-side credential.
The framework does not pick your posture. It makes you name it, publish it, and accept where that lets the workload run.
CARLOS does not choose your security posture. It makes you declare it, in one published letter, and then refuses to place a workload on a host that is not trusted enough to hold what it holds.
The classes order S ≤ A < B < C, and hosts order by who controls the box. A workload runs only where the host is at least as trusted as its class requires, which in the platform's own idiom is: nothing that sees may be placed where nobody is accountable for seeing. The class attaches to a workload, not to a product: an end-to-end encrypted app whose operator runs an automation sidecar is two different placement answers at once.
Not a roadmap. Every row below was answering on the public internet when this page was last deployed, and each one names the version it is serving in an X-Carlos-Version response header.
| Product | Host | What it is | Class |
|---|---|---|---|
| Tito | go.tito.io | Ticketing for conferences and events, on its own self-hosted CARLOS deployment in its own cloud account. | C |
| Keymail | keymail.dev | Email, but secure, and the identity provider the rest of the family signs in with. | A2 |
| Kass | home.kass.training | A training app for personal trainers and the people they train. | A2 |
| Woodstar | woodstar.app | A public microblog on the same model, with its own protocol server alongside it. | A2 |
| Amadan | amadan.net | A production tenant running on the flagship deployment. | — |
| Cribado | cribado.report | DMARC aggregate reporting, including a mail-receiving instance on port 25. | — |
| Carloku | carloku.com | The hosted CARLOS platform itself — console, dashboard and edge — deployed the same way everything else is. | S |
| Framework sites | rastrillo.org · carlosframework.com | The framework's own pages, shipped and promoted through the same immutable-release pipeline as any app. | S |
A dash means the workload has not published a class yet. Eleven Messenger and Slopbox are where two of these shapes came from, and are not deployed on CARLOS — they are listed here as sources, never as adopters. Seapointish has no public host by design, which is what class B looks like from outside.
The framework is the intersection, not the union. A shape earns its place by appearing more than once.
CARLOS was extracted rather than invented. Five systems arrived at the same architecture independently — a messenger, an email service, a social network, a file store and a training app — and The Eleven Factors had already set out what small, sovereign software should promise the people who use it. CARLOS is the shape that keeps those promises in code.
Extraction is real and it is unfinished, which is worth saying on a homepage rather than in a footnote. Rastrillo, the web framework that gives a CARLOS app its shape, is adoptable today at v0.6.0: filesystem routing, a manifest system, a component vocabulary, fingerprinted assets, a development watch loop, and a bootstrap that speaks the platform's activation contract. The deployment substrate underneath it runs the fleet in the table above. Other pieces still live inside the applications they were pulled from.
The conventions travel ahead of the code: the principles, the stack and the infrastructure shape are distilled into a Claude Code skill, so a new system can start on the model today.
The same binary and the same pipeline in all three. What changes is whose account the boxes are in.
One static binary, a bucket and DNS. No account to sign up for and no component you cannot see. This is the mode everything else is measured against.
SELF-HOSTED How the platform worksYour account, your buckets, your regions, your data-processing agreements. A workload can be pinned to a region because the fleet is a list of boxes you own.
BRING YOUR OWN BOXES Read the deployment modelCarloku is the flagship CARLOS deployment, offered as a hosted platform: the same architecture and the same guarantees, with none of the boxes to look after, and nothing that stops you taking it back.
HOSTED Go to carloku.comAI finally made building software fast. CARLOS makes what you build worth keeping.
