Kore

Before the first line of business logic

Building an enterprise application means around thirty building blocks that have nothing to do with the customer's business. They are not optional, and they get paid for either way: up front if you write them, later as debt if you postpone them.

• Multi-factor authentication, roles, tenant isolation and a screen framework: three to six months before the first business screen.
• Assembling Keycloak, n8n, Alfresco, Grafana and AWX yields five tenant models, five directories and five audit logs that no single query can correlate.
• Document management, connectors and workflows are not saved either: they come back later, as debt, at the worst possible moment.
• Throughout, the team is not building what makes the product distinctive — it is reimplementing what everyone already has.

What Kore replaces

Kore does not fit an existing category, so the honest way to describe it is to start from what a team already maintains. The third column is the most important one in the table.

"Platform to model on" means the engine, the data model and the screens are there, and your business still has to be described: a workflow engine with no modelled process, document management with no filing plan, replace nothing until something is configured on top. It is fast because the platform exists; it is not instant, and we would rather say so beforehand than afterwards.

What Kore does

Forty-six functional domains and 1,620 API operations — counted on the source code, not estimated. These are the ones found in just about every business application.

Users, roles and fine-grained permissions

Access control is not a module bolted on afterwards: it runs through every domain. A denied permission is denied in the screen, in the API and in the export alike.

• Role-based access control across five levels, more than thirty "resource.action" permissions, groups with inheritance, privilege-escalation prevention.
• Password authentication, TOTP, passkeys/WebAuthn, magic link, email and SMS OTP, trusted devices.
• Sessions tracked in real time, soft and hard expiry, automatic logout, traced impersonation.
• API tokens in eight kinds, with scopes, rotation and quotas.

Nested organisations and tenants

Multi-tenancy is hierarchical and verified: tenants nest, rights propagate to descendants, and switching context does not leak one tenant’s data into another tenant’s screen. This is precisely what a platform assembled from five tools cannot guarantee, because it holds five different notions of "tenant".

An audit trail nobody rewrites

Every operation is logged, each entry cryptographically sealed, along with the IP address and the browser, and the log’s integrity can be verified. Asking "who did what, on which resource, in which tenant, last month?" takes a query — not a log-correlation project.

One GraphQL API

1,620 operations (737 queries, 867 mutations, 16 real-time subscriptions) behind a single typed entry point. Real time runs over WebSocket with an event bus, and permissions apply object by object — a subscription returns nothing beyond what the person is allowed to see.

Your business objects arrive with their screens

In almost every application there are things being tracked: cases, jobs, requests, incidents, risks. They have a state, an owner, a due date, a discussion thread — and they get rebuilt every single time. Kore provides this once and for all: declare the object type and its fields, and the kanban, the Gantt, the calendar, the backlog, the roadmap and "my work" are wired to it.

• Service-level commitments by category and priority, with business hours, pause states and breach detection.
• Assignments, comments, attachments and change history — on any resource, not only on tickets.
• Public intake forms that create the record directly, and automatic generation of recurring tasks.

Workflows and business rules

A state engine with a visual editor, nine trigger types (alert, audit, notification, playbook, timer, webhook and more), timers and escalations. Alongside it, a rules engine with condition trees, per-entity overrides, traced simulation and persisted compliance. The mechanism is provided; the processes and the rules remain your organisation’s.

Documents and artefacts

A folder tree with versions, check-out and locking, and fine-grained permissions by user, role, group or tenant, propagated down the tree. Six storage backends to choose from — local, S3/MinIO, database, Redis, memory, hybrid — with signed URLs. Alongside them, artefacts: versioned files, encrypted at rest, carrying continuous-integration metadata and an expiry.

Data connectors

More than thirty-five bidirectional sources — SQL, NoSQL, REST, GraphQL, SOAP, files, MQTT, iCal, SMS and AI providers — under governance: encrypted credentials, SSH tunnelling, rate limiting, circuit breaker, queueing, caching. The transformation chain (flatten, filter, sort, deduplicate, validate, format) is configured without writing code, and the mapping engine is versioned and reversible.

Translations, theme and menus

Five languages (EN, FR, DE, ES, IT) across every module, with editable overrides and tooling that checks no key is missing or left behind. Light and dark themes and colours are customisable per tenant and per application, and menu entries are driven by permissions and by the licence: a user does not see a screen they have no right to.

Exports, GDPR and reversibility

Export and import in CSV, JSON, YAML and XML on any resource. Consents are versioned and immutable, with automatic re-consent on publication; export and erasure can be run by the person themselves and propagate to the applications in the ecosystem. The data stays in a standard PostgreSQL, in no proprietary format: leaving remains possible.

Agentic AI, not one more assistant

Kore exposes a native MCP server: an assistant genuinely manipulates resources, under the identity of the signed-in user, with a deny-by-default access policy and sandboxed execution. One session loads the tools of every application in the ecosystem — without ever exceeding the rights of the person driving it.

Operations

Remote agents across five kinds of target, native Ansible execution (Vault, Galaxy, dry run), thirty-one state collectors, a web console and terminal, orchestrated security scans, automated Playwright and k6 tests, and high-availability deployment with automatically provisioned TLS certificates.

What it changes for a business application

ClubTT is the simplest demonstration of the argument: software aimed at volunteer-run associations, priced for associations, that nonetheless arrives with per-folder permissions, an audit trail and a full export. Not because they were written for it, but because it sits on Kore.

Kore is deployed as is, or serves as the platform for an application built with you — turnkey, co-built, or platform only if your team would rather develop against the API.

What Kore does not do

Better said up front than in the second month. These gaps are deliberate and documented; they are not worked around with clever wording.

• No inbound SSO: no inbound OIDC or SAML, no LDAP/AD, no SCIM, no social login. That is disqualifying for a large account with a central directory, and it is the first priority on the roadmap.
• No BPMN 2.0, no DMN, no durable execution in the Temporal sense: the state engine covers business processes, not modelling standards.
• Document management has no full-text search, no OCR, no preview and no online co-editing: it suits governed filing, not high-volume office use.
• No multi-level on-call rotations and no complete incident management: Kore does not replace PagerDuty for a structured on-call team.
• Thirty-five generic connectors to configure, not four hundred ready to click as with an integration specialist.
• No native mobile app: the web interface is responsive, and that is all it is.
• No dedicated AI guardrails — no personal-data or toxicity detection, no per-tenant cost analysis.