One binary in front of a bucket. The bucket holds the repositories; the local disk holds only a warm copy that can be deleted at any time.
Repositories are scoped to your Navitech ID. Git itself signs in with a token you mint after you are in.
gitly token on the host mints one without it.