Demo Mode

How Demo Mode Works

The demo page at /demo asks a visitor for a work email, then signs them into a real, live session — not a static mockup. Behind the scenes:

• The email is submitted to POST /api/demo/request, which rate-limits by IP, stores the lead, and (if DEMO_LEAD_NOTIFY_EMAIL is configured) sends a best-effort notification — this never blocks the visitor from continuing even if the notification email fails.
• The visitor is then signed in as a dedicated, pre-seeded demo account belonging to its own tenant — the "GuardFox Demo" organization — isolated from every real customer's data by the same organizationId scoping used everywhere else in the app. Demo visitors never see real tenant data, and vice versa.
• Every write request from a demo session is rejected at the middleware layer (any non-GET call to /api/*), so the read-only guarantee holds regardless of which page or feature is being explored — it isn't a per-feature toggle that could be missed on a new page.

What's pre-loaded (curated by lib/demo-seed.ts, not random test data):

• 5 EDR agents across Windows, Linux, and macOS, including one shown quarantined
• 8 alerts spanning Critical → Info severity, tied to a believable incident narrative (ransomware, lateral movement, credential access, exposed service, deception-engine trigger)
• 24 SIEM events across authentication, network, endpoint, malware, policy, and audit categories
• A live SOAR playbook with real run history

Sharing the demo

The demo URL is https://demo.guardfoxsecurity.com/demo. Share it directly — visitors only need to provide an email, no account creation.

Configuring the Demo

Unlike a feature flag, demo mode isn't something you turn on — the /demo route, its dedicated organization, and its seed dataset are always present. The only optional configuration is lead notification, in .env.local:

[email protected]   # optional — where to send a ping when someone requests the demo

If unset, demo requests are still stored (queryable via the DemoRequest table) — you just won't get an email ping per request.

Resetting demo data

The demo organization's data resets automatically — 90 seconds after the server starts, then every 6 hours on a schedule (see server.ts), wiping and re-seeding via resetDemoOrg() so relative timestamps ("2h ago") always look fresh. There's no manual reset command or cron env var to configure — it's a permanent background job on the running server, the same pattern used for scheduled data-retention enforcement.