Built for connections that move under you.

A vendor ships a breaking change, an MCP server changes its tools, an agent starts calling something new — and it reaches every connection that depended on it, including unexpected ones.

Ngentix remaps what it is sure about and asks you about the rest — on your own infrastructure, unlimited users, unlimited flows.

What it builds, and where it stops.

The engine reads an API and writes the connector: discovers the surface, infers the mapping, tests it, and repairs it when the far side changes. 107 systems are in the catalog today. The catalog is what's already built, not the limit.

Every mapping is scored — how confident the engine is that a field on their side means what it appears to mean. Above the line it maps on its own; below it, a named person answers a question with the engine's best guess attached. The same line governs what gets repaired later without asking. It ships at a sensible default per connector, and it is yours to move when a source deserves more scrutiny or less.

Coverage
REST / JSON Cataloged and engine-built. This is the path the engine builds on its own, from an API it can read.
Webhooks Inbound events are deduplicated, so a provider replaying one does not move the same record twice. When a connector drifts, the outbound notification is signed and retried until it lands.
MCP Agents act through the same authorized connections a person does — the same confidence line, the same approval gates, the same record.
Where it struggles An undocumented API, or one whose field names carry no meaning, is where the engine earns its keep least: it will map what it can and hand you the rest as questions. The catalog is the work already done; outside it, budget time with someone who knows what the fields mean.

Two ways to run the same engine.

The question is never where the software sits. It's who keeps it healthy, and whether the data leaves your environment at all.

Shared · hosted by us

We operate it, for everyone.

Shared infrastructure we run and monitor. Every fix resolved on anyone's connector improves it for everyone. The fastest way to find out whether the engine handles your systems, with nothing to deploy.

Licensed · in your cloud, you operate

It runs in your account.

The same engine, deployed standalone in your own cloud or datacenter. Nothing ever leaves your environment — data residency stops being a preference and becomes a fact you can show an auditor. You operate it; we keep the product working under it.

In both cases Ngentix is a proxy for apps you register yourself: your administrator authorizes access to each vendor under your name, records pass through, and nothing is retained. What differs is whose account they pass through, and who operates the engine that moves them.

What your security and legal teams will ask for.

Record payloads Never retained. Records are read from the source, mapped, written to the destination, and not kept. This is the row a security reviewer is checking for.
What is stored Credentials and tokens, encrypted; field mappings and confidence scores; flow definitions; the audit record. All of it on the deployment you run on — never the payloads themselves.
Whose app your customer authorizes Yours. Your administrator registers the app and authorizes access under your name; Ngentix is the proxy carrying records on its behalf, not the application holding the relationship.
Residency A licensed deployment runs inside your own account, in the region you put it. Residency stops being a preference you negotiated and becomes a fact you can show an auditor.
Your compliance perimeter Because the deployment sits inside your account, it inherits the controls you already run there — your key management, your network boundary, your logging, your existing audit scope. Nothing new to certify separately.
The audit record Every mapping decision, every confirmation and every repair is recorded, on your deployment. What the engine did on its own and what a person approved are distinguishable after the fact.
Evidence you can pull yourself The deployment reports its own encryption posture and secrets inventory over an API, and will export them. Your reviewer does not have to take a questionnaire answer on trust — they can read the running system.

The detail behind each of these — what crosses which boundary, what is persisted, and where flows run — is in Architecture and data handling.

You run it. We keep it working.

A license, not a managed service. The stack deploys in your cloud or your datacenter, for as many users and as many flows as you like, and you use it as you see fit.

Who owns it
The deployment Yours. You operate it, on your infrastructure, inside your perimeter.
The confidence line Yours to move. It ships at a default. Your people answer the mapping questions that fall below it.
Your users Yours. Who gets access, which teams see what, how it fits your existing change process.
The product Ours. L1 through L3 on our own defects — a connector broken in a way you can't fix is our problem, not a ticket you own.
Updates We publish. You apply. New connectors, engine improvements and every fix are published to your deployment. You choose when each one goes in, so it lands inside your change window rather than ours.

The clause that matters most is the last one. Every defect we fix is published to every deployment, so a breakage another licensee hits is fixed before you hit it — and you choose when it goes in, inside your own change window. That is the thing self-hosting normally costs you — you take the perimeter and give up the fleet's learning. Here you keep both.

Named actors, rules, approvals, and a record.

Every action on the map has a name against it — a person or an agent — the rule that allowed it, who approved it if approval was needed, and a record that outlives the conversation.

Ngentix · control plane The Ngentix console: a list of proposed actions, each with the actor that raised it, the rule that allowed it, and an approve or decline control.

The audit question stops being a project. When someone asks who changed a field, or why a record moved, the answer is a query rather than a reconstruction — and it is the same answer six months later, when the people involved have moved on.

Thirty, sixty, ninety.

What the first quarter looks like when it goes well. One connector, your own systems, your own data.

day 30
one connector, proven

Proof

One connector against your real API, your confidence line, your fields. A named engineer on our side for the whole window.

day 60
first flows in production

Production

Real data moving between two systems your teams depend on, running on your schedule.

day 90
your backlog, cleared

Scale

The integrations you've been deferring, built by the engine rather than your roadmap.

Where support starts and stops.

Worth being exact, because a vague boundary here becomes an argument later.

Our defects L1 to L3. A connector or the engine misbehaving in a way you cannot fix is ours to fix. This is the support contract.
Below the line Your operators answer the mapping questions the engine raises. That is the work the confidence line decides the size of, and it is yours.
Your systems Access, credentials and change control inside your perimeter stay with your teams — we do not hold keys to your environment.

You don't have to believe we'll be here in three years.

Every vendor gets asked what happens if they're acquired, or if they fail. Most answer with a promise.

Ours is structural. The developer apps are registered to you, not to us — the authorizations your administrators granted survive us. You operate the engine in your own account, which means the thing you depend on is already inside your perimeter, on infrastructure you control, running whether or not we answer the phone. A buyer who could operate it themselves doesn't need a promise about our future.

Buyers usually have to negotiate data-portability and exit terms into a contract. We'd rather offer them: mappings and flow definitions export in a documented format, and the apps stay registered to you.

The smallest version of yes.

Nobody should stand up a deployment to find out whether an engine works. So don't. Run it on our hosted infrastructure first, against one real system, and move it in-house once you know.

What a first step looks like
Scope One connector between two systems you actually run, with your real data.
Environment Ours. Nothing to deploy, nothing for your infrastructure team to schedule. It moves into your own environment when you decide it should.
Window Fixed and short. Long enough for a change on the far side to happen at least once — that's the part worth watching.
Success criteria Written by you, agreed before we start, so the outcome isn't a matter of opinion at the end.
Who's on it A named engineer here for the whole window, in a channel with your team.
If it doesn't hold up You stop. The developer apps you registered stay yours and keep working, and you have learned something true about your own systems.

Questions a committee asks.

Who fixes it when a connector breaks?

We do, L1 through L3, when the defect is ours — the engine or a connector misbehaving in a way you cannot fix from your side. That is the support contract, and it is deliberately narrow so it is worth something: we are not staffing a helpdesk for your systems, we are standing behind our own product.

The work that stays with you is the mapping questions the engine raises below your confidence line. You control how much of that there is by where you set the line.

What happens to our integrations if you disappear?

The developer apps are registered to you, not to us, so the authorizations your administrators granted survive us. A licensed deployment runs in your own account, on your infrastructure, whether or not we answer the phone.

Mappings and flow definitions export in a documented format. We would rather offer that than have you negotiate it into a contract.

How is this different from the integration platform we already have?

Most platforms give you a connector and leave maintaining it to you. The engine writes the connector from the API and repairs it when the far side changes, and every fix we make is published to every deployment — so a breakage another licensee hits is fixed before you hit it, and you choose when to apply it.

That is the part self-hosting normally costs you: you take the perimeter and give up the fleet’s learning. Here you keep both.

What does it take to run it ourselves?

It deploys into your cloud account or datacenter and is operated by your team, for as many users and as many flows as you like. We keep the product working under it — new connectors and every engine fix are published to your deployment, and you decide when each one goes in.

Can we try it before deploying anything?

Yes, and you should. Run it on our hosted infrastructure against one real system first, with success criteria you write, and move it in-house once you know. Standing up a deployment to find out whether an engine works is the wrong order.

Let's get you running.

Two fields, and a person replies — usually the same day.

We'll only use your details to reply to this. No sequence, no list.