Trust
What is built, and what is not
This page is organised around one line: which of these is a control in the software, and which is a certificate somebody outside this company signed. We have a good deal of the first and none of the second, and mixing them up is the thing a page like this usually does.
If a claim below matters to your decision, ask us to show you the code that implements it. All of it is in one repository and every item here has tests behind it.
Built, tested, and running
One business cannot see another
Every tenant table carries row-level security enforced by Postgres, not by a WHERE clause we remember to write. The application connects as a role that cannot bypass it, and a request that names the wrong workspace returns nothing rather than somebody else’s customers. A test suite runs on every commit that sets up two businesses and tries, by every route the API offers, to reach across.
Everything the model saw is on the record
Every turn, tool call, policy denial and guardrail verdict is written to an append-only log that a database trigger refuses to update or delete. Every number on your dashboard is a projection of it, so a figure can always be opened down to the conversation it came from.
Rules are enforced, not requested
What the agent may call, what needs a second confirmation, what goes straight to a person, and what may never be said are checked at the boundary by code. A model that decides to try anyway is refused, and the refusal is logged with the rule that produced it.
Identifiers are redacted before they are stored
Card numbers, one-time codes and national identifiers are redacted at the ingress — before the append-only log is written, not after — so an identifier a customer pasted never lands in a transcript that will later be exported.
A workspace can actually be erased
Deletion reaches Postgres, Redis, the memory banks, the vector store and object storage, and the report names any store it could not reach. The append-only guard is narrowed for the purge rather than lifted, so erasing one business cannot touch another’s log. A record of the erasure survives it.
And so can one person
A right-to-erasure request is a route your own team can run, not a support ticket to us — DPDP §12 and GDPR Art. 17 have deadlines. It follows merged records, so a person who was folded into another profile goes with them.
Who looked at what
Reads are logged as well as writes, because who opened a customer’s memory is the question an auditor actually asks. Both logs are append-only and visible to your own admins in the console.
Data residency
Every workspace is stamped with a region and the platform is deployable in one — a single box or a Kubernetes cluster, entirely self-hosted, with no managed dependency you did not choose. Region selection is recorded per workspace; it is not yet enforced at the storage layer.
No vendor lock at the model layer
Models are reached through one fabric, so which vendor answers a turn is configuration. Nothing in the product depends on a specific provider.
Not yet — stated plainly
This list exists so the one above can be believed.
No certifications
We do not hold SOC 2, ISO 27001, HIPAA attestation, PCI DSS or FedRAMP. Not "in progress" — not started. The controls above are engineered and tested; none of them has been audited by anyone outside this company. If your procurement process requires a certificate, we cannot pass it today and will say so at the first meeting rather than the fourth.
No SSO, SAML or SCIM
Sign-in is a magic link to a work email, with roles and scoped API keys behind it. There is no identity-provider integration and no automated deprovisioning.
Observability keeps its own copy
If you enable tracing, the tracing tool stores prompts and completions in its own store under its own retention, and our erasure cannot reach inside it. Our purge report names it rather than leaving it to be discovered.
Backups are not yet off-box by default
A self-hosted deployment takes a nightly database dump to local disk. Shipping it somewhere else, and rehearsing a restore, is your deployment’s job today and is documented rather than automated.
Region is recorded, not enforced
A workspace carries a residency setting and the deployment honours it by where you run it. The platform does not yet refuse a write that would land outside it.
Reporting something
If you believe you have found a vulnerability, tell us before you tell anyone else and we will confirm receipt within one working day. We will not pursue anyone who reports in good faith, and we will tell you when it is fixed.
Last reviewed 2 September 2026. This page is maintained alongside the code it describes; when a control lands it moves lists, and when one is removed it moves back. See what each industry pack enforces.