Application platform

Kore — The self-hosted foundation for business applications

Q: What is Kore, and who is it for?

Kore is the Koraisoft multi-tenant application platform: users, roles and permissions, nested organisations, a sealed audit trail, a GraphQL API, workflows, document management and data connectors, ready to carry a business application. It is aimed at software vendors, integrators and IT departments building applications that serve several customers or entities, who do not want to rewrite those building blocks on every project. It is deployed as is or serves as the platform for an application developed with Koraisoft.

Kore is the platform every Koraisoft application is built on. Permissions, the audit log, the API and workflows exist before the first line of business code: an application delivered by Koraisoft therefore comes with permission management, an audit trail and a full export that nobody had to redevelop. Users, roles and fine-grained permissions, organisations, translations, GraphQL API, workflows, documents, data connectors.

Self-hostableOne GraphQL APISealed audit trailGo and PostgreSQL

Kore administration dashboard: organisations, users, active sessions, unread alerts and recent activity by action

The problem

Building an enterprise application means around thirty building blocks that have nothing to do with the customer's business. They are not optional, and they have to be paid for either way: up front if you build them, later as debt if you postpone them.

Multi-factor authentication, roles, tenant isolation and a screen framework: three to six months before the first business screen.
Assembling an identity provider, a workflow engine, a document management system, a monitoring stack and a deployment tool yields five tenant models, five directories and five audit logs that no single query can correlate.
Document management, connectors and workflows are not avoided either: they come back later, as debt, at the worst possible moment.
Throughout, the team is not building what makes the product distinctive — it is reimplementing what everyone already has.

What Kore replaces

Kore does not fit an existing category, so the clearest way to describe it is to start from the tools a team already maintains. The third column is the most important one in the table.

Maintained today	What Kore brings	On installation
An identity provider	Identity and access: MFA (TOTP, passkeys, magic link, email and SMS OTP), hierarchical roles, API tokens, traced impersonation. Kore also ships an OAuth2/OIDC authorisation server for your other applications.	Usable as is
An integration tool, or home-grown connectors	More than forty data providers, a dozen of them with read-write connectors, encrypted credentials, SSH tunnelling, rate limiting, caching.	Usable as is
A workflow engine, or scheduled scripts	Workflow engine: state machine, visual editor, eleven kinds of transition action, timers, escalations, translated labels.	Platform to model on
A document management system	Document management: folder tree, versions, locking, fine-grained permissions down to the tenant with propagation, six storage backends.	Platform to model on
An on-call and alerting tool	Alerting: deduplication, loop prevention, per-category throttling, acknowledgement and resolution cycle.	Platform to model on
An activity tracker, or spreadsheets	Activity tracking: six ready views (kanban, Gantt, calendar, backlog, roadmap, "my work"), service-level commitments, assignments, comments, recurrence.	Platform to model on

"Platform to model on" means the engine, the data model and the screens are there, and your business still has to be described: a workflow engine with no modelled process, document management with no filing plan, replace nothing until they are configured. Setup is fast because the platform exists, but it is not instant.

What Kore does

More than 1,600 API operations — counted on the source code, not estimated. These are the domains common to most business applications.

Users, roles and fine-grained permissions

Access control is not a module bolted on afterwards: it runs through every domain. A denied permission is denied in the screen, in the API and in the export alike.

Role-based access control — five hierarchical system roles plus custom roles —, more than five hundred "resource.action" permissions, groups with inheritance, privilege-escalation prevention.
Password authentication, TOTP, passkeys/WebAuthn, magic link, email and SMS OTP, trusted devices.
Sessions tracked in real time, soft and hard expiry, automatic logout, traced impersonation.
API tokens in eight kinds, with scopes, rotation and quotas.

Role list: each role carries its named permissions, with a count of the further permissions not shown — Roles and their permissions

Nested organisations and tenants

Multi-tenancy is hierarchical and verified: tenants nest, rights propagate to descendants, and switching context does not leak one tenant’s data into another tenant’s screen. This is precisely what a platform assembled from five tools cannot guarantee, because it holds five different notions of "tenant".

Organisation list: the type of each one (administrator, federation, organisation, client) and its parent organisation — The organisation hierarchy

A tamper-evident audit trail

Every operation is logged, each entry cryptographically sealed, along with the IP address and the browser, and the log’s integrity can be verified. Asking "who did what, on which resource, in which tenant, last month?" takes a query — not a log-correlation project.

Audit log: timestamp, user, action, resource type and id, IP address — The audit log

One GraphQL API

More than 1,600 operations (some 770 queries, 900 mutations and 16 real-time subscriptions) behind a single typed entry point. Real time runs over WebSocket with an event bus, and permissions apply object by object — a subscription returns nothing beyond what the person is allowed to see.

Your business objects arrive with their screens

Almost every application has objects to track: cases, jobs, requests, incidents, risks. They have a state, an owner, a due date, a discussion thread — and they are rebuilt on every project. Kore provides them once and for all: declare the object type and its fields, and the kanban, the Gantt, the calendar, the backlog, the roadmap and "my work" are connected to it.

Service-level commitments by category and priority, with business hours, pause states and breach detection.
Assignments, comments, attachments and change history — on any resource, not only on tickets.
Public intake forms that create the record directly, and automatic generation of recurring tasks.

Workflows and business rules

A state engine with a visual editor, eleven kinds of action to attach to a transition (alert, audit, notification, validation, playbook, timer, webhook, starting another workflow and more), timers and escalations. Alongside it, a rules engine with condition trees, per-entity overrides, traced simulation and persisted compliance. The mechanism is provided; the processes and the rules remain your organisation’s.

Workflow catalogue: version, number of states and number of transitions for each definition — The workflows shipped with the platform

Documents and artefacts

A folder tree with versions, check-out and locking, and fine-grained permissions by user, role, group or tenant, propagated down the tree. Six storage backends to choose from — local, S3/MinIO, database, Redis, memory, hybrid — with signed URLs. Alongside them, artefacts: versioned files, encrypted at rest, carrying continuous-integration metadata and an expiry.

Data connectors

More than forty data providers — SQL, NoSQL, REST, GraphQL, SOAP, files, MQTT, iCal, SMS and AI providers —, a dozen of them with read-write connectors (SQL databases, MongoDB, Redis, Elasticsearch and OpenSearch, InfluxDB, MQTT, REST, SMS sending), under governance: encrypted credentials, SSH tunnelling, rate limiting, circuit breaker, queueing, caching. The transformation chain (flatten, filter, sort, deduplicate, validate, format) is configured without writing code, and the mapping engine is versioned and reversible.

Configured data sources, broken down by type: database, AI provider, REST API, custom — with URL, priority and endpoint count — The configured data sources

Translations, theme and menus

Five languages (EN, FR, DE, ES, IT) across every module, with editable overrides and tooling that checks no key is missing or left behind. Light and dark themes and colours are customisable per tenant and per application, and menu entries are driven by permissions and by the licence: a user does not see a screen they have no right to.

Agentic AI, not one more assistant

Kore exposes a native MCP server: an assistant genuinely manipulates resources, under the identity of the signed-in user, with a deny-by-default access policy and sandboxed execution. One session loads the tools of every application in the ecosystem — without ever exceeding the rights of the person driving it.

Assistant session: the agent queries the platform through successive tool calls, each one gated by an authorisation prompt, and reports exact counts of organisations and users — A real exchange: the agent calls the tools, and every call asks for authorisation

Operations

Remote agents, native Ansible execution (Vault, Galaxy, dry run), thirty-seven state collectors, a web console and terminal, orchestrated security scans, automated Playwright and k6 tests, and high-availability deployment with automatically provisioned TLS certificates.

Node fleet: kind (agent or backend), attached service, deployed version with an upgrade-available indicator, and last heartbeat — The node fleet and their versions

Declared topology maps, with the number of node types and edge types in each — The topology maps

What Kore changes

Club TT is the simplest illustration: software aimed at volunteer-run associations, that nonetheless arrives with per-folder permissions and an audit trail. Not because they were built for it, but because it is built on Kore.

The business logic starts in week one

No quarter of technical groundwork before the first useful screen. Koraisoft's applications are built with AI, on Kore: each reached a first usable state within a few months. AI speeds up writing code; the platform removes from scope what would otherwise have to be written, verified and maintained — authentication, permissions, tenant isolation, audit, administration — building blocks already proven in production by all of these applications.

One model, one audit trail

A tenant, a user, a permission, an audit entry: defined once and honoured by every domain. That is what makes a cross-cutting question answerable — and what an assembly of five tools will never deliver.

Sovereign, without reservation

Deployed on your own servers, including off-network. Go and PostgreSQL, in no proprietary format. GDPR is in the product rather than in a procedure: immutable versioned consents, access and erasure rights the user can exercise themselves.

Kore is deployed as is, or serves as the platform for an application built with you — turnkey, co-built, or platform only if your team would rather develop against the API.

The platform and AI

Koraisoft develops its applications with AI, on Kore. Neither replaces the other: one speeds up writing code, the other reduces what is left to write, verify and maintain.

Guarantees already proven

Tenant isolation, permission propagation, a sealed audit trail: in these building blocks, a subtle error is costly and comes to light late. Kore provides them with behaviour already proven by several applications in production, rather than new code to be validated in full.

One fix for every application

A flaw fixed in the platform is fixed for every application built on it. Generated separately, the same building blocks would have to be fixed as many times as there are applications.

A precise framework for the assistant

Established conventions, a shared data model, a single GraphQL API: the assistant works on the business domain of the application, within a framework it does not have to rebuild for every project.

AI inside the application, within the user's rights

Kore's MCP server lets an assistant act on the application's data, under the identity of the signed-in user and without ever exceeding their rights.

Frequently asked questions

What is Kore, and who is it for?

Kore is the Koraisoft multi-tenant application platform: users, roles and permissions, nested organisations, a sealed audit trail, a GraphQL API, workflows, document management and data connectors, ready to carry a business application. It is aimed at software vendors, integrators and IT departments building applications that serve several customers or entities, who do not want to rewrite those building blocks on every project. It is deployed as is or serves as the platform for an application developed with Koraisoft.

Is Kore self-hosted, and what are the technical prerequisites?

Yes: Kore is installed on your own servers, including off-network, and the data stays in your database. The backend, the agent and the command-line tool are binaries written in Go; the only required database is PostgreSQL. Redis is only needed when the backend is spread across several instances.

How much does Kore cost?

Kore pricing is under review: contact Koraisoft to discuss it.

Do you need a platform, or an identity provider and a framework?

Kore brings together, on a single tenant and user model, what an assembly has to stitch together: tenant isolation, permissions enforced down to the API and the export, a sealed audit trail, workflows and document management. It is a starting point for a multi-tenant business application, not an identity component to integrate with the rest.

When is Kore the right starting point?

When the application has to serve several clients or entities, be governed and audited, and stay with you. The tenant hierarchy, the sealed audit trail, workflows and document management come with it rather than being built: the technical team starts with the business domain, not the plumbing.

Why a platform, when AI can generate this code?

Because generating the code is only the beginning: it still has to be reviewed, tested, secured and maintained, application after application. Koraisoft uses AI to develop its applications, and does so on Kore: the assistant concentrates on the business domain, while authentication, permissions, tenant isolation and audit come from a platform already proven in production.

Which applications are built on Kore?

Three Koraisoft products are built on Kore: kFleet, which drives virtual machines, containers, networking and security; kForge, which manages repositories, continuous integration and metrics per client; and Club TT, management software for table tennis clubs. Two proofs of concept rely on it too: kAssist for home automation and kFolio for tracking a securities portfolio. All of them share the same accounts, permissions and audit trail.

Talk about your project

Considering a multi-tenant business application? Write to us and we will look together at whether Kore can fit.

Our products evolve continuously. The features, screens and characteristics shown on this page describe their state at the time of publication: they may change, be modified or be withdrawn without notice, and do not constitute a contractual commitment.