Documentation

What Sapilon is

Sapilon turns a legacy system or an AI-built prototype into production-ready, AWS-native software you own outright, using a governed AI agent whose permissions are written into the code itself.

Your first project

Create a project from the projects list, give it your existing code or a written description as input, and open it. Each project is an isolated workspace with its own repository, wallet draw, and stage.

The four stages

Every project moves through Design (shape, mocked data), Build (real backend on the Build Server), Rehearsal (dress rehearsal on the Rehearsal Server), and Live (production). Each transition is a gate that checks readiness rather than a deploy button.

Your first Ask

Ask for one outcome at a time, say what it is for and what must not change, and read the diff before you accept it. A good brief is the difference between one turn and five.

Naming what you see

Your app's screen is made of named regions (the nav rail, the sidebar, the page header, the main area and the aside panel), and naming the one you mean turns a vague request into a precise one.

Existing System

Answer one question about where your current system lives, and the product gives you a short, ranked list of what to bring, with a plain explanation of what the agent has to guess if you skip each one. Telling us something does not exist is a real answer.

Data migration

Point us at your old data. We read what it holds without copying it, you choose what to bring, and we work out how it fits the new system — every decision written down for you to accept or disagree with. Each run reads the data fresh and loads it; rehearse as often as you like on the Rehearsal Server, read a report that says whether the totals match, and only then go Live. Nothing reaches your Live data without every row being checked first — and, with a Rehearsal Server, drilled there.

Tasks

A task is one piece of work queued for the project, written by you or split out by the agent from a larger request, and it is the record of what is planned rather than the mechanism that does the work.

Plans

A plan is the agent’s written proposal for a change large enough that building it straight away would be a guess: what it understood, the decisions it needs from you, the steps it would take, and the technical approach behind them.

Project history

Every project keeps a record of the agent sessions, releases and review runs behind it, so what changed, when, and at what cost is answerable after the fact rather than reconstructed.

Architecture

Architecture is where you decide how your app runs for real people. Answer how bad a day of downtime would be and what sensitive information it holds, and Sapilon suggests one of three options (Essential, Balanced or Dedicated), side by side. Once one is chosen, the page opens on it, with Change architecture to pick another. Choosing is free until the project moves to Rehearsal. After that, a change shows what would change and its steps before anything starts.

Settings

Settings holds what is about the project itself — its name, its description, what the agent remembers, keeping it up to date, and switching it off — while everything about the app you are building lives in Explorer.

Agent memory

The agent keeps short notes about corrections, preferences and facts it could not have learned from your project, on its own. It shows each one as it saves it; you can undo a turn or delete a note in Settings.

Sign in with Apple

Turn on Sign in with Apple on the Authentication page, register a Services ID and a key in your Apple Developer account using the values Sapilon shows you, then give Sapilon the Services ID, Team ID, Key ID and the .p8 key file, and publish.

Sign in with Google

Turn on Sign in with Google on the Authentication page, create an OAuth client in the Google Cloud Console using the two values Sapilon shows you, then paste the client ID and secret back into Sapilon and publish.

Sign in with Microsoft

Turn on Sign in with Microsoft on the Authentication page, choose personal accounts or one organization, register an app in Microsoft Entra with the redirect URI Sapilon shows you, then paste the client ID, the client secret value (and for an organization, the tenant ID) back into Sapilon and publish.

Single sign-on (OpenID Connect)

Turn on Single sign-on on the Authentication page, create an OpenID Connect web app in your identity provider with the redirect URI Sapilon shows you, then paste the button name, issuer URL, client ID and client secret back into Sapilon and publish.

Roles and permissions

Every app starts with Admin and User. Add roles on the Users page when you need more, give each role what it may do, and assign people to roles there or let the app’s admins do it. Nothing is allowed unless something allows it, and a deny always wins.

Your own web address

Add your address in the Web addresses card on the Publish page, create the two records it gives you at your domain provider, and wait. The Sapilon address keeps working the whole time and afterwards. Every web app on a server shares that one address, each on its own path.

Moving the sign-in page

Moving the sign-in page takes about twenty minutes, and nobody can sign in while it runs or until your record has spread. People already signed in stay signed in. Do it out of hours — and Use the Sapilon sign-in address puts it back in one click.

Your iOS app

Publish to Live, open the iOS App page, enter your bundle identifier and Apple Team ID, and choose Create iOS app. Then open ios/App.xcodeproj in Xcode on a Mac, archive it and upload it to App Store Connect. Your web app keeps updating through Publish, with no new App Store release.

Your website

Choose + beside Your Apps, pick Website and name it. Sapilon creates a www/ folder, an Astro site that builds to plain HTML pages. Ask the Agent to write the pages, check them in Preview, and publish it from its own Publish page: the website goes live on its own www address, beside your apps, with no sign-in.

Integrations

Open the Integrations page, choose a tool and connect it once. Your app can then use it in Build, Rehearsal and Live through Sapilon, which keeps the credential encrypted and lets the app make only the requests that integration allows. Integrations are not sign-in methods.

Secrets

Open Secrets under Services, add a name and a value for each server (Build, Rehearsal, Live). Your app reads it by name. Values are write-only: you can replace or remove one, never view it. Check Integrations first; use a test key for Build.

Users

Users lists the people of one server at a time. Invite someone by email in a role, change their roles, add an exception, or suspend them without losing anything they did. Looking at Live is logged.

Airtable integration

Read, create and update records in your bases. Connect it on the Integrations page; your app then calls Airtable through Sapilon without ever holding a Airtable credential.

Dropbox integration

List folders, upload and download files, and create share links. Connect it on the Integrations page; your app then calls Dropbox through Sapilon without ever holding a Dropbox credential.

Google Calendar integration

Read and create events on a shared calendar. Connect it on the Integrations page; your app then calls Google Calendar through Sapilon without ever holding a Google credential.

Google Drive integration

Create and read files your app made or the user picked. Connect it on the Integrations page; your app then calls Google Drive through Sapilon without ever holding a Google credential.

Google Sheets integration

Read ranges and append or update rows in a spreadsheet. Connect it on the Integrations page; your app then calls Google Sheets through Sapilon without ever holding a Google credential.

Notion integration

Search, read and update pages and databases. Connect it on the Integrations page; your app then calls Notion through Sapilon without ever holding a Notion credential.

Slack integration

Post messages, list channels and look up people in a workspace. Connect it on the Integrations page; your app then calls Slack through Sapilon without ever holding a Slack credential.

Stripe integration

Read customers, payments, invoices and subscriptions. Connect it on the Integrations page; your app then calls Stripe through Sapilon without ever holding a Stripe credential.

Telegram integration

Send messages and documents as a bot, and receive replies. Connect it on the Integrations page; your app then calls Telegram through Sapilon without ever holding a Telegram credential.

WhatsApp Business integration

Send template and text messages to customers. Connect it on the Integrations page; your app then calls WhatsApp Business through Sapilon without ever holding a Meta credential.

Ownership zones explained

Every part of your codebase carries one of three markers, //!AUTO (the agent owns it), //!SAFE (the agent proposes, you approve) and //!DEV (humans only), written in the source itself, so AI permissions are code you can read and change.

Editing generated code

Edit anything you like, and your changes are checkpointed as their own version before the next agent turn, but code you intend to keep hand-writing belongs in //!DEV or //!SAFE, or a later turn may rewrite it.

When the agent stops

A stopped turn is usually governance working as designed: the agent needs an answer, needs your approval on a //!SAFE diff, hit a failing check, or reached an action that requires a verified expert's verdict.

Your expertise, and who can help

Set your level per area under Account → Expertise. When anyone needs help, colleagues at Working or Expert who said they can be asked are offered first (free), then a Sapilon expert with the price shown up front.

Design

Design settles what the app is: screens, flows, data model and architecture, running against mocked data with nothing deployed, so changing your mind is nearly free.

Build

Build replaces mocked data with a real backend, database and integrations on the Build Server (the first 50 hours are free), so the app works end-to-end before anyone pays for production infrastructure.

Rehearsal

Rehearsal runs the finished app on the Rehearsal Server, where you drill the data migration, walk the real journeys, and check security and running cost while it is still safe to be wrong.

Live

Live is production: the new system takes over, the old one is retired, and the same governed workflow keeps shipping changes with versioning, monitoring and backups behind them.

Promoting between stages

Promotion runs a readiness gate (tests, health, architecture and stage-specific checks) that can pass, pass with warnings, or block; it is a check on the project, not a deploy button.

The servers

A project runs on up to four servers (Design, Build, Rehearsal and Live), each created when the project reaches the stage it serves. Design is free and the first 50 Build Server hours are free; Rehearsal and Live are real standing infrastructure, monitored and backed up, and drawing from the wallet while they exist.

Automated Tests

Tests are generated per feature rather than per file, run on demand on the Build Server, and reported as which features are covered and passing, so the answer to "did that change break anything" is a run rather than an opinion.

Checkup

A checkup looks at three things on one page — whether your project was set up correctly, whether one version of the code is ready to ship, and how the app is protected — and turns what it finds into findings you fix, waive, queue as tasks, or hand to an expert before promoting.

Security

Security is one area of plain-sentence rows — scans, edge protection, access — that keeps being re-checked after promotion, because a dependency that was clean at the gate can become a known vulnerability weeks later.

Accessibility

Every screen your app builds from the Sapilon UI kit is made to meet WCAG 2.2 level AA, and the AAA level for contrast (through High contrast), touch target size, focus appearance and motion. Your own content — images, link wording, video, plain language, custom brand colours — is still yours to get right.

Migration safety

Before a version reaches the Rehearsal or Live Server, every database statement it would run is classified as safe, risky or lossy. Lossy ones need your explicit acknowledgement, risky ones are run first against a scratch restore of a backup, and either kind gets a fresh backup right before it runs for real.

Wallet and top-ups

Sapilon runs on one prepaid wallet that AI points, AWS hosting and expert time all draw from; the first 50 Build Server hours are free, there is no subscription and no seats, and the balance cannot go negative.

Points

A point is Sapilon's fixed-price unit of AI usage with one published rate, so an interaction costs a predictable whole number instead of a token bill you can only understand afterwards.

Costs and usage

Costs & Usage adds up everything one project costs (AI, experts, and the cloud services your deployed app runs on) in one total you can filter by period, category and environment.

What a turn costs

Every agent turn reports what it cost in points and why, so cost is something you read after each turn rather than discover at the end of the month.

Expert work pricing

Expert work is priced by job size: Small (under 30 minutes) and Medium (about an hour) at fixed prices, Large billed hourly against an estimate and a cap you approve before anything starts.

Gift cards

A Sapilon gift card adds its full amount to your organisation’s wallet in one step: open Billing, choose Redeem gift card and paste the code, or follow the link in the email. It has no cash value and works once.