Security & governance
Deploy across a team
Put Conifer on every machine in the org and set policy without standing up a server to watch them.
The runtime exists so prompts and weights never leave the box. Route everything through a central service to read the logs and you have thrown away the property you paid for. Conifer keeps the guarantee and still lets IT set policy and confirm posture: deploying to a hundred machines never needs a hundred-and-first in the middle.
No collection server
Your deployment runs no Conifer backend. The app on each laptop talks to no control plane and opens no channel home. Governance rides the infrastructure you already run: MDM pushes policy down, and your own EDR or MDM reads posture back up. Conifer honors the policy it is handed and writes an honest record of what it is running; collecting that record is your tooling’s job.
The three rails
Fleet control runs on three independent rails. Each rides something the org already operates, and none is Conifer-hosted.
| Rail | Carried by |
|---|---|
| Policy push | An MDM configuration profile, plus a build that expires |
| Posture pull | A structured posture document your EDR or MDM collects per endpoint |
| Authoring | An in-app console that writes the profile and reads the audit trail |
The policy clamp can only remove capability. No profile key grants one, so a malformed or absent policy lands on the consumer default.
Rolling out
Deployment is ordinary software distribution.
- Distribute the signed, notarized build through MDM, an internal mirror, or your standard installer pipeline. See Install for what the app does and does not ask for on first run.
- Author a policy in the in-app admin console, starting from a vertical preset if one fits, and push the profile through MDM.
- Have your EDR or MDM gather the posture document from each endpoint’s well-known path.
The boundary holds per machine
Scaling out changes the count, not the contract. Each install is the same self-contained thing: local inference touches the network zero times on every one, and a local-only routing policy holds a whole fleet to that lane.
| Read next | What it covers |
|---|---|
| The local-first guarantee | Why local inference has zero egress. |
| The grant model | The per-agent authority the org policy clamps on top of. |