Set up your workspace.
Put your team to work.

Applications & responsibilities

Glyph Private · Linux server

Your shared enterprise service for accounts, models, Knowledge Base, policies, audit, and licensing. IT operates one Linux AMD64 server using Docker Compose and PostgreSQL 16.

Glyph · Apple Silicon Mac app

The employee workspace for signing in to the private server, receiving organization policy, chatting with approved models, and using the text Knowledge Base. Deploy the approved DMG and matching backend ZIP together.

Server administration · web console

Administrators use the private server’s HTTPS address to configure users, models, policy, licensing, and operational status.

Fortaify · organization account

Use Organization controls for the hosted organization associated with your pilot. Hosted account settings and the private server console have separate responsibilities; use the account and organization identifiers supplied during onboarding.

IT owns infrastructure, certificates, models, backups, and managed Mac configuration. Fortaify supplies the approved software pair, signed pilot license, matching deployment tooling, and agreed onboarding support. Arrange your pilot before deployment.

Mobile and Windows enterprise, HA, formal SLA, broad connectors, Agents/MCP, large-scale deployments, and unvalidated regulatory or compliance guarantees are outside this pilot.

1. Deploy Glyph Private

1. Prepare a Linux AMD64 host with Docker Engine 24+, Compose 2.20+, Python 3.12 with venv for the supplied CLI, corporate DNS, valid TLS certificate/key and CA chain, and backup storage. Size model hardware for the approved Ollama chat and embedding models.
2. Download the approved server archive and verify its SHA-256 before loading it. The archive contains the Docker image; deployment tooling, activation, and model weights are supplied separately.

sha256sum glyph-private-1.0.0-paid-pilot-linux-amd64.tar.gz
docker load --input glyph-private-1.0.0-paid-pilot-linux-amd64.tar.gz
docker image inspect glyph-private:paid-pilot-amd64 --format '{{.Id}} {{.Architecture}}'

Expected archive SHA-256:

Expected image ID: sha256:ce8e017c947128d118b3e2f8a258484c3696cf54fd785289fe5c9a00eeffbc62 Architecture: amd64.

3. From the supplied deployment package, install its CLI dependencies in a virtual environment. Use glyphctl init with your hostname, the approved image, and your certificate/key/CA paths, then glyphctl install. Follow the matched deployment procedure supplied at onboarding; loading an image alone does not configure a running service.
4. Open your server’s HTTPS URL at /setup. Use the bootstrap token from the local file named by setup to create the recovery administrator. Store recovery credentials in your company vault; never send the bootstrap token to support.
5. Install the supplied license verification public key in the deployment configuration. Upload the separately issued signed pilot license under System → License. A download does not activate a subscription.

2. Configure your organization

1. In the server console, configure your organization and record its identifier and signing public key for managed clients.
2. In Models, register the approved Ollama endpoint using openai_compat, its base URL without /v1, the exact backend model ID, and the appropriate chat or embedding capability. Approve it, run Health, and create the default chat alias.
3. Configure the Knowledge Base embedding model before uploading documents. Keep model endpoints private and use the TLS arrangement agreed with IT.
4. In Users, create the named pilot accounts and assign only their required roles. Deliver temporary passwords through your company’s approved channel. The pilot uses administrator-created accounts and password login.
5. Publish the agreed signed policy: approved company model, secret protection, and no external tools or providers. Confirm the licensed seat count and policy state in the Deployment dashboard.

Use the Fortaify organization account

1. Sign in to Fortaify and open Organization controls for your pilot organization. Available sections depend on your role and contract.
2. Check Plan access for issued entitlements and Usage & seats for capacity. Contact sales to change contract access; an enabled entitlement does not expand the supported pilot scope.
3. In Members & seats, authorized administrators manage hosted membership, roles, and assigned seats. Hosted invitations target existing Fortaify accounts and are accepted on their Organizations page. This is separate from creating private-server login accounts in the server’s Users console.
4. If included in your onboarding configuration, use Private deployment → Register deployment to name your server and record its HTTPS endpoint. Copy the one-time registration token into the supplied deployment configuration and keep it secret. Check the reported version and last-seen state after the server checks in.
5. Use Devices, Policies, and the audit view to review the organization’s enrolled devices, policy state, and administrative changes. Coordinate any policy publication with IT and verify enforcement on an enrolled Mac.

Keep billing and legal responsibilities separate. License or billing administration does not by itself authorize legal-hold management. For any configured legal hold, the authorized legal role must manage it; do not remove holds to bypass retention or deletion restrictions.

Before onboarding, run the supplied CLI from its virtual environment:

venv/bin/python glyphctl --directory /srv/glyph preflight

Resolve failures and record the disposition of warnings. Confirm a ready model, organization, valid license, TLS, storage, and schema readiness.

3. Install & enroll managed Macs

IT supplies the approved Glyph 1.3.5 Apple Silicon DMG and matching backend ZIP, along with authenticated checksums. The public consumer installer or an older backend is not a substitute.

1. Verify both checksums. Mount the DMG and copy Glyph.app to Applications. Preserve its signature and quarantine; do not disable Gatekeeper or modify the application bundle.
2. With Glyph closed, deploy the matching backend using the supplied managed-Mac installation procedure. On a fresh account it lives in ~/Library/Application Support/Glyph/backend. Preserve framework symlinks and the matching version metadata. If a backend already exists, use IT’s upgrade procedure rather than overwriting it.
3. IT installs the administrator-owned managed.json containing the private server URL, organization identifier, and signing public key, plus company CA trust if required. Do not put passwords or tokens in that file. This managed configuration keeps restrictions active after logout.
4. Launch Glyph normally. Choose Organization or business → Set up work device. In Settings → Enterprise → Private Server, connect to your company’s HTTPS address and sign in with the administrator-created account.
5. Enroll and fetch policy. Check the displayed organization, policy version, approved model, and installed backend version before use. IT controls pilot updates.

If macOS rejects the app, certificate trust fails, or Glyph requests a different backend download/repair, stop and contact IT. Do not approve an older runtime or bypass platform security.

4. Use chat & the text Knowledge Base

Chat with an approved model

1. Confirm you are connected to the organization’s private server and select the approved model or default alias.
2. Start a conversation with a synthetic or non-sensitive prompt. Check that the actual model returns a response.
3. Review the response before using it in business work. Model output can be inaccurate; policy approval does not make an answer authoritative.

Work with shared text knowledge

1. Use the Knowledge Base workspace to upload an approved, non-sensitive text document, such as a sample handbook containing a known fact.
2. Wait for ingestion and embedding to finish before querying. An upload alone does not confirm the document is searchable.
3. Ask a question about the known fact and check the retrieved information against the source text. Administrators should verify the approved embedding model is healthy if indexing fails.

Keep the configured embedding model consistent. Switching to a model with different vector dimensions requires a planned reindexing workflow with IT.

5. Verify policies & access

Administrators publish signed organization policies; enrolled clients validate and enforce them. Assign users and actor groups through the authorized administration workflow, then verify the affected user receives the intended policy. A visible policy setting is not sufficient evidence of enforcement.

1. As an enrolled user, perform an allowed chat with a synthetic prompt.
2. With IT, demonstrate secret protection using only the approved synthetic test fixture. Verify desktop redaction before transmission and server rejection of a raw synthetic secret.
3. Attempt an excluded tool/provider action and confirm it is refused. Do not enable Agents/MCP or connectors to work around a block.
4. Review the relevant audit event and confirm role restrictions using an account with the intended access.
5. Quit Glyph normally, relaunch, and verify session/reconnection, organization policy, chat, and Knowledge Base retrieval again.

6. Audit, backup & recovery

Review the deployment

Authorized administrators review audit records and the Deployment dashboard for user/seat counts, license state, policy state, and model health. Use the audit view for supported activity and administrative changes; access remains governed by assigned roles.

Back up in an agreed maintenance window

venv/bin/python glyphctl --directory /srv/glyph backup --output /secure/backups/glyph-before-upgrade

Choose a new backup path. The single API stops while PostgreSQL, configuration, secrets, TLS, and data are copied, then restarts. Backups contain secrets and workspace content: store them in company-controlled encrypted storage off the server, never in a support ticket. Model weights are excluded.

Restore deliberately

Use the recorded release image and the supplied recovery procedure. Run a restore dry-run first; it checks checksums and image compatibility, not SQL execution. Actual restore replaces database, configuration, and data, losing later writes. Preserve the failed state, confirm the correct deployment ID, and have IT approve the recovery window. Verify login, policy, chat, a known Knowledge Base fact, and any active legal hold after recovery.

Upgrade only to an approved release

Keep the desktop, matching backend, server image, and release record together. Use the supplied upgrade/rollback workflow and its pre-upgrade backup. The pilot has no zero-downtime promise and does not advance the public consumer updater.

Troubleshooting & support

Cannot connect or sign in

Check your private server URL, company network access, certificate trust, account, organization, and server health with IT. Never disable TLS verification.

No model response

Administrators run Models → Health and confirm the Ollama endpoint, exact model ID, default alias, and policy permissions.

Knowledge Base is not ready

Confirm ingestion completed and the approved embedding model is healthy. Test one known fact from a small text document.

Policy or licensing blocks an action

Check enrollment, organization, signed policy version, assigned role/group, license state, and seat count. Ask the authorized administrator to resolve the configuration; do not bypass enforcement.

For support, use the contact agreed at onboarding and include application version, server image identifier, the affected workflow, and a sanitized description. IT can generate the allowlisted diagnostics archive:

venv/bin/python glyphctl --directory /srv/glyph diagnostics --output /secure/glyph-support.tar.gz

Do not send credentials, bootstrap tokens, raw logs, database dumps, backups, or customer content. Contact Fortaify if you need to arrange onboarding or identify your support contact.