Capabilities

What FortressFlag does

Flip features in production without a deploy, target exactly who sees them, and keep every change accountable - from your first flag this afternoon to SSO and approvals at scale. Seven SDKs carry it all, client and server.

Flags & targeting

Definition to running code in about a minute. Client apps are evaluated per device and only ever receive their own values - never the ruleset; your own backends can pull the full ruleset behind a server key and evaluate it in-process.

Boolean & multivariateBoolean, string and number kinds with named variants. A flag's kind is immutable; keys are permanent; renames are display-only.kinds: 3

Targeting rulesOrdered rules with AND-condition groups, per environment - including semver comparisons like appVersion ≥ 2.0. Device tags are evaluated and forgotten, never persisted.first-match-wins

Reusable segmentsNamed condition lists shared by rules across flags and environments, so “beta testers” is defined once.per-project

Percentage rolloutsPer-flag cohorts bucketed on a hash of device and flag - nothing about any device's cohort is ever stored.sticky cohorts

Custom environmentsCreate, rename and reclassify your own environments. Production is a class on the row, not a magic name - call it “live” and every safeguard still applies.is_production

Delivery

How flags reach your code - and why the polling is nearly free.

Seven SDKsiOS, Android and web on the client; Go, Node.js, Python and Java on the server - every one fail-safe by contract: a read always resolves to a value, outage or not.client & server

Local server-side evaluationServer SDKs download your ruleset and evaluate every flag check in-process - no network hop per check, no per-evaluation latency in your request path.in-process

Effective pollingEvery response carries a strong ETag; an unchanged poll answers 304 with no body. Your fleet can check often and transfer almost nothing.etag · 304

Offline-first clientsClient SDKs cache the last known values durably and keep serving them through any outage - a device that restarts offline evaluates with what it last saw.durable cache

Safety

Production is guarded by design, not by convention.

Peer-approved changesA developer proposes a production change; a second person approves, which applies it. Self-approval is refused, and the audit log names both parties.second person

Scheduled changesBoolean toggles take effect at a chosen time - exact for every reader, not “whenever the cron ran”.exact-at-T

Reversible deletionArchive, restore, purge with a retention window, so a mis-click is recoverable and true deletion is deliberate.archive → purge

Stale-flag nudgesFlags untouched for 90 days get badged and filterable - a nudge, never an auto-archive.90 days

Teams & access

Enterprise access control from the first seat.

Role-based accessOwner, Admin, Developer, Viewer - the role matrix is published in-app, and nobody can grant a role above their own.4 roles

Project allowlistsViewers and developers see exactly the projects they were granted; an ungranted project is indistinguishable from a nonexistent one.404, not 403

SSO & SCIMBring your identity provider: SSO sign-in, automated provisioning and deprovisioning, and IdP-group-to-role mapping.saml · okta

MFATOTP second factors, enforceable per organisation.totp

Audit logEvery state change: who, what, when, from where, before and after - with an in-app viewer, filters and CSV export.append-only

Automation

A machine credential and an agent-facing tool surface — both inheriting the same permissions, not new ones.

Management API tokensA token carries the role of the member who created it, in one organisation — so it can never do more than they can. Full or read-only, shown once, revocable, and it dies with the membership.acts as you

MCP server for AI agentsGive a coding agent your flags. Reading is always available; changing needs an explicit flag, and a production toggle needs a confirmation naming the environment. A developer's agent proposes rather than writes — and approving stays a person's job.--allow-writes

Billing

Metered on devices, not on apps - the pricing page explains why that is cheaper for you.

Per-device seatsA seat is a monthly-active device, deduplicated across your whole app family. Simulators are served flags and never billed, and server-side evaluation adds no seats.monthly-active

Usage transparencyAn owner-only Usage screen: devices this period, a year of history, and daily request activity.12 months

See it with your own flags

A trial organisation comes seeded with a working example project - first 1,000 monthly-active devices free.

Start free trial