No one exports spreadsheets anymore.
A small program runs on your own server, next to your ERP or DMS. It reads only what it declares — read-only — and ships it over a channel encrypted and authenticated on both ends.
Works with the system you already have — ERP, DMS or spreadsheet. Nothing changes in your operation, and no port is opened on your network.
Decision-maker: the security guarantees · IT: the full install
It reads. It never writes.
The agent is deliberately small and constrained. What it can do fits in three lines — and so does what it can’t.
Reads only what the queries compiled into the binary declare — starting with accounting entries — and only what is new or diverged from the control totals.
Ships to the AutoController gateway over a channel encrypted and authenticated on both ends (mTLS).
Runs as a Windows service under its own virtual account: starts with the machine, recovers from crashes and writes logs with no data content.
Never writes to your system and never receives SQL from the cloud: the cloud only picks the domain and the window, and the database login only has SELECT on what the manifest declares.
Opens no inbound port on your network: the agent calls out to the cloud, never the other way round — and always to two fixed names, built into the binary, that your IT can pin in the firewall.
Keeps no business data on the machine and sends nothing anywhere but the AutoController gateway — it never talks to the cloud database directly.
Seven layers between your database and the internet.
The same end-to-end model: certificate identity, an mTLS channel and least privilege at every link.
One certificate per agent identity
Each agent gets its own certificate, valid for 7 days and renewed at half-life by proving possession of the current key. The previous one is revoked the first time the new one is used. Without a valid certificate, the gateway refuses the connection.
mTLS on both ends channel
All communication is encrypted and authenticated on both ends: the agent proves who it is — and so does the gateway. Between the agent and your database, the connection is always encrypted too.
Two fixed destinations, by name destination
The agent talks only to the AutoController ingestion gateway, in São Paulo, which answers on two names — pinned in the binary, not an editable field. Your IT can restrict the server’s outbound traffic to those two names, and the trust anchor ships inside the binary: diverted traffic does not authenticate.
A key bound to the machine credentials
The agent’s private key is born non-exportable in the machine’s TPM. Without a TPM, the agent uses a software key restricted to the service — and declares it to AutoController. With Windows integrated authentication, no password is stored at all.
One tenant per company isolation
In the central database, each company sees only its own data: the tenant comes from the certificate, never from the payload, each record is encrypted with the company’s key, and isolation is enforced by the database, not the application.
Read, and only what is declared privilege
The agent’s login has SELECT only on the tables and columns in the manifest, which your DBA applies and audits — never db_datareader, never write. On our side, the gateway can only execute the staging write routines, with no direct access to the tables.
Immediate cut-off revocation
A compromised certificate is revoked on the server and loses access on the very next request. An expired certificate does not renew: it requires a new enrollment.
Installed in minutes.
A local wizard walks through four steps — on the machine your system already runs on, with no runtime and no third-party software.
1 · Database
A read-only SQL login for your ERP or DMS, with SELECT only on what the manifest declares (agente manifesto lists tables, columns and version for your DBA). The connection is always encrypted.
Installation guided by the AutoController team, together with your IT. Interactive demo of the local wizard — data shown is sample data.
Only what changed. Nothing lost in silence.
Three requests, all from the cloud. New: whatever sits above the watermark, with a short overlap. Totals: counts and sums per company × account × day, computed by the source database itself. Close: the whole period, checked against the trial balance before it closes.
If it diverges, the whole slice comes back. If a slice’s totals do not match, the whole slice is re-extracted — and a deleted entry becomes a visible reconciliation divergence, never a silent loss.
A cycle with no change writes nothing. If nothing is new and every slice matches, only the totals are recorded: volume grows with your activity, not with how often cycles run.
Ships raw, nothing is replaced. The agent does not transform data or keep a checkpoint: the watermark lives in the cloud. Every version lands in append-only staging, and reprocessing means re-deriving from it.
Every run, on the record.
Cycle by cycle: what the cloud requested, how many entries came back, how long it took and where the watermark stands. The history shows up in the panel — no SSH, no asking IT for logs.
- Run status and history right in the panel.
- A failure does not move the watermark, which lives in the cloud — the next request covers the same window.
- 7-day certificate, renewed automatically at half-life; the previous one is revoked.