---
title: "Business apps: say yes without losing control · while"
url: https://while.sh/en/it-teams/
updated: 2026-11-09
---

# Your business teams build their apps with AI, say yes without losing control.

With while, their agent deploys them behind the company sign-in, and you decide who gets in.

## What you would have to assemble is already there

### Each app opens to whoever you choose, and no one else

With the company account, by group or by domain.

### Business teams work on their own, and nothing important happens without you

You choose who approves what, two-person approval included.

### You know who did what, and you can prove it

The activity log is signed and verifiable. With the Enterprise plan, it streams to your SIEM.

### A business app doesn’t put the others at risk

Each app runs isolated from the others, and the business team’s agent fixes the known vulnerabilities in its dependencies, checked at every deployment, then every day.

### The company’s keys stay secret, even from the agents

Apps and agents use your tools without ever seeing the key.

### Your data stays in France, with a French company

Your apps and their backups are hosted in France, by Nextmap.

## What your security team will ask

Identity Apps open with the company sign-in, over OpenID Connect, with Microsoft Entra, Google Workspace, Okta, Keycloak or any other provider.

Approvals You set rules by role, by group and by app, with two-person approval if you like. An agent never approves.

Activity log It is append-only, chained and signed. It can be exported and re-verified with a small script.

Isolation Each app runs in its own sandbox, with no access to the other apps. Its outbound traffic to the internet is closed by default.

Known vulnerabilities Each app’s dependencies are checked against known vulnerabilities at every deployment, then every day, and the business team’s agent updates them.

Backups Every day, they go to storage outside the cluster where the apps run, dedicated to your organization and encrypted with AES-256. They are kept for 14 days.

Cutting access You disconnect an agent, revoke a key or a token, close a person’s sessions or remove an access, at any time.

Leaving The code of each version is archived. Data can be exported as CSV or as files.

## Questions

### Getting started

#### A CFO wants to share their tool: where do we start?

They ask their agent to deploy the tool for their team, and you approve the access.

#### Do we need a team to run while?

No, there is nothing to install or run on your side.

### Governance

#### How do we oversee the agents of business teams and contractors?

Each agent acts with its person’s permissions, and your rules say what waits for an approval.

#### Can a business team open an app to the internet without IT?

No, by default, making an app public waits for an admin’s approval.

#### Who maintains these apps?

The business team’s agent maintains them, within the rules you have set.

#### What if a business team’s agent breaks its app?

It rolls back to the previous version on its own.

### Data

#### Can the apps use our tools, like the ERP or the CRM?

Yes, each tool connects as a data source, which you approve.

#### Can one app read another app’s data?

Only after your approval, and read only.

#### Can an agent delete the database of an app in production?

No: on while, replacing or destroying a production database always waits for a person’s approval.

#### Can we bring over apps that are on AWS or Heroku?

Yes, the agent takes over the code, copies the database from a backup and carries over the environment variables, as in the guide [Leaving Heroku](https://while.sh/en/guides/migrate-from-heroku/).