Adoption · on-premise
Inside your perimeter, on your terms.
The engine, the CLI, the SDKs, and the specification are Apache-2.0, and tovio serve — in that same CLI — is a real bidirectional server anyone can run, with no agreement and no vendor. The Forge collaboration platform is a separate, commercial product: dedicated enterprises run it on their own infrastructure under agreement, and only TOVIO operates it as a service.
The stack
What runs freely, and what is commercial.
Open core means the line is drawn somewhere. Here is exactly where — no layer is described as “open” when it is not.
Engine, CLI, SDKs, specification
The object store, change model, merge engine, permission enforcement, CLI, language bindings, and the wire protocol and storage specifications. Yours to run, modify, and keep, with no agreement and no vendor.
tovio serve
A real bidirectional server inside the Apache-2.0 CLI: clone, fetch, and push over TLS 1.3, with the write-policy gate enforced. Complete version control, including cryptographic per-file permissions — without the collaboration platform. Its connection ACL is open by design and lane protection is a Forge-edge gate, so it is a peer-to-peer relay, not a review-gating server.
Forge server
The collaboration platform: durable store, proposals, events, audit routes, connection ACL, authenticated REST, admin and backup surfaces, metrics, and native plugins. Available to dedicated enterprises on their own infrastructure under a commercial agreement, and operated as a service only by TOVIO.
Key Authority (Tier-1)
An authorization oracle for team-tier recipient decisions. You run it; it never holds the content keys of paths it authorizes.
Enterprise Key Authority and identity connectors
Threshold, KMS, and HSM authority plus directory sync, SSO, and SCIM are commercial components on the enterprise train, and follow the evidence gate on the compliance page.
Hosted TOVIO Cloud
The managed option, for teams that would rather not operate any of the above.
Runbook
Six steps, in the order that avoids rework.
Not a quickstart — the sequence an operator would choose if they were going to keep this running for years.
- 01
Start with the agreement
The Forge is a commercial product, and its binary will be distributed through an entitled channel rather than a public download. That channel is not open yet, so today the licence conversation comes first and the build is arranged with it — everything below assumes that is in place.
Talk to us → - 02
Stand up the Forge behind TLS
The server speaks TLS 1.3 and is exercised over real transports in its own hermetic test suite. Terminate where your organisation normally terminates and give it a certificate it can present.
About the operator docs → - 03
Decide who may connect at all
The connection ACL is the outer boundary, evaluated before any repository-level authorization. Getting this right first means a misconfigured policy later is a second failure, not the only one.
About the operator docs → - 04
Run the Key Authority you intend to keep
Tier-0 needs no authority at all. Tier-1 team encryption needs one, and it is the component your recipient decisions depend on — so plan its availability and its recovery story before your first protected path exists.
About the operator docs → - 05
Prove backup and restore before you need it
The Forge has an administration and backup surface. A backup that has never been restored is a hypothesis; restore into a scratch host and clone from it.
About the operator docs → - 06
Plan for growth deliberately
Replication, scaling, and high-availability options are documented. Published evidence at the declared ceilings is part of the remaining assurance work, so size against your own repositories.
About the operator docs →
Current status · as of 2026-08-03
- No signed release artifacts are published yet. Package managers, installers, and containers are deliberately not advertised as available. Treat any deployment today as a pre-release evaluation.
- The hosted service is not available yet. Until it opens, an on-premise agreement is the route to the collaboration platform.
- The Forge is a commercial product. Its binary will be distributed through an entitled channel rather than a public download — that channel is not open yet — and only TOVIO operates it as a managed service. The Apache-2.0 stack — the engine, the CLI with
tovio serve, the SDKs — runs with no agreement and no vendor, and always will.
Operate it on your own terms.
The operator documentation covers deployment, hardening, identity federation, organisational governance, and the administration surface.