CARLOS
Why your organisation would run on CARLOS, and what you get when you do.
For adopters · draft 3 · September 2026 · carlosframework.com
Adopter edition of the deck. No funding content. The motif is the same owned instance: one binary and one file inside a boundary that is yours.
where you are
Per seat, per month, forever. Your data in someone else's tables. Their outage, their roadmap, their price rise.
The problem from the buyer's side. Spoken: every one of these was a fair trade fifteen years ago, because owning meant servers, patching and uptime. The next slides are what changed.
Aimed at vendor excess: enterprise features nobody asked for, AI badges on everything, a trust centre instead of a database you can inspect. Not at the legitimate reasons your team chose SaaS. Say it, pause, move on.
the answer
One app binary and one database file, with updates and operation still managed.
The value proposition. Mechanics (Go, SQLite, channels, hibernation, residency) are in the appendix.
what you get
Each app is one instance per team, open, and yours to run wherever you like.
Team chat. Replaces Slack, Teams.
Email and sign-on. Replaces Gmail, Outlook, Okta.
Docs, sheets, calendar, files. Replaces Google Workspace, Microsoft 365.
Code hosting and CI. Replaces GitHub, GitLab.
Social. Replaces the feed you do not control.
Mailing lists. Replaces Mailchimp. shipping this week
Shipped or shipping apps only. Ocho (personal messaging) and Dineraya (payments) are in development and sit in the appendix catalogue with their status. Trust posture per app is also in the appendix: Eleven, Keymail, Woodstar and amadan are end-to-end encrypted; Oficina is sealed per team; Correomona is server-side with named leaks tested.
secure
That is the test every CARLOS app is held to. For most of the suite, the answer is nothing.
Isolation is the operating system's boundary, not a WHERE clause; there is no team_id column. E2EE apps leave no plaintext in storage, proven by canary tests. Apps that must read data (mailing lists) list every plaintext column and a CI test fails when a new one appears. What the test does not prove (key handling, live-host compromise) is in the appendix.
fast
One binary, one file next to it, server-rendered pages. No client framework to download before you see a word.
Wake time is what the family's apps see day to day, not a published benchmark; say so if asked. Memory 20 to 60 MB per running tenant. Details in the appendix.
cost
A parked app runs no process. Its data waits in storage until the next request wakes it.
Cost depends on where it runs: self-hosters pay for their own hardware and storage only. Carloku is one hosted option; its rate sheet is in the appendix.
where it runs
Hosting is a choice made outside the instance's boundary.
Same hostname, same pages, same sign-on in every mode. A host is anything that can reach the storage bucket; an on-prem box is outbound-only, no inbound port, no SSH. Two boxes and one bucket survive the loss of either. Mechanics and caveats in the appendix.
residency
Residency is enforced where the instance wakes, not promised in a policy PDF.
Tito's three regions. The per-region bucket is reachable only by that region's hosts at the IAM layer. Replicated copies, blobs and logs follow the platform's retention window. No deployment is certified yet; the compliance appendix lists the evidence the system produces and the work remaining.
control
Pin a version, pick the moment you move, or ship your remix to your own channel and keep everything else.
Eleven has per-user update choice today; platform-wide it is next. Channels, promotion gates and the fork mechanics are in the appendix. The point: ownership is also who decides when the software changes.
people and agents
The same handler serves both. An agent cannot take a shortcut a person could not, and writes need a sentence a human would approve.
Actions opt in as typed tools; calls route through the app's own middleware. No bundled LLM client, no MCP: the agent surface is the app's actions. Every platform command is designed for someone with no access to the boxes. Details in the appendix.
building on it
One command from a branch gives you a canary behind your real sign-on, in seconds. Idle canaries sleep, so ten experiments cost almost nothing.
The canary verb landed on main 2026-09-04. A dev environment is a channel with one subscriber. Pipelines carry bake windows, passkey step-up and approvals.
evidence
Its own cloud account, hosts, storage and domains, on the published deployment modules.
The reference third-party self-hoster. Restore figures from Tito's infrastructure README.
Same five-file shape for every app, open, forkable with sign-on, edge and trust tier intact. If you can read one CARLOS app you can read all of them.
how to start
The migration path: edge in front (Tito's Rails proof of concept did this), data home per region, idle parts hibernating, hot paths rebuilt as CARLOS apps. Each step is reversible. Detail in the appendix.
status
One honest slide, plainly, before the close. Product-by-product status is in the appendix catalogue.
next steps
Close and next steps in one. Links replace the appendix. Confirm the docs URL before sharing; add a contact.
