What people can reach
Every answer is limited to what the person asking could already open.
Every search or question over your documents carries the asker’s own permissions, mirrored from your Microsoft and Google sources and re-checked every few minutes.
Protection is on from day one. A missing or unreadable enforcement record resolves to enforced, never to open, and if anything goes wrong while working out what someone may see, the system shows less, never more.
Owners and admins reach documents through the same rules as everyone else. Nothing from a personal OneDrive or Google Drive becomes company-wide knowledge, and a fact learned from restricted documents is shown only to people who can still open them, checked at read time.
A removed document drops out of search and answers immediately, administrators included. A document’s audience is recorded in the same step that creates it, so a document cannot exist without one.
Identity and tenancy
Nothing runs for a caller who has not proved who they are, and nothing crosses from one organisation to another.
Every backend operation is blocked unless the caller proves who they are. The check is wired around every operation, so a new feature cannot ship unprotected, and the only exceptions are three documented categories, each with a written justification.
Customer data is scoped to the organisation the session belongs to, never to one named in the request. Someone who belongs to several organisations has their role re-read for the one they are entering, and arrives with nothing if it cannot be read.
Sessions live server-side with idle and hard lifetimes. Role and membership changes are pushed into live sessions, suspending an organisation cuts everyone in it off within about one request, and the session token never reaches JavaScript. Single sign-on verifies the provider’s signature and every claim, with PKCE, a one-time state and a nonce.
Hosted on Microsoft Azure. New organisations get a dedicated knowledge graph, with isolation enforced in the application. Connections are made over TLS. Storage and database encryption at rest is provided by Azure, and on top of that we encrypt connection credentials ourselves before they are stored, with key rotation.
A document can try to give orders. It is read as material, never as instructions.
Email bodies, retrieved passages and connector results reach a model fenced as data to report on, not directions to follow. The risk signals a guardrail reads are computed by the platform and stripped from anything the model supplied, so an AI employee cannot clear a gate by omitting or forging a flag. Autonomy is earned across four levels, each tool can be set to always ask, use the earned level or trust that one tool, and an unrecognised setting falls to the cautious middle, never the permissive end.
Each action is checked against the specific capability the AI employee is acting under. Where no binding exists, the call is denied rather than falling back to something it can do elsewhere.
Irreversible legal commitments, financial transactions above the threshold, ending business relationships, changing the organisation’s structure, granting autonomy to another agent, reaching outside the organisation, anything involving personal data, and computer use below the autonomy floor.
A blocked action goes to a human queue carrying the exact action and parameters, runs only on approval, and the executed action links back to the approval that authorised it.
AI employees have no general code-execution surface, and cannot choose whose credentials they act with. The connected identity is server-assigned, and a caller-supplied one is rejected.
Content coming in
Every file, message and connector result is checked before it can touch anything else.
A file is accepted only when its byte signature, extension and declared type agree on a type we accept. Executables are refused by signature and scripts by extension.
Malware scanning runs inside our own trust boundary, and a scan that cannot complete is a refusal. Office files are checked for decompression bombs through their directory listing, never unpacked to find out.
Extracted text is scanned for personal data and masked before it is chunked, embedded or indexed, so the masked version is the one every downstream system sees.
Connector endpoints must be HTTPS, are refused if they resolve to an internal or cloud-metadata address, and the connection is pinned to the address we verified.
All chat, embedding and ranking traffic leaves through a single gateway under our control. Every call carries tenant attribution, and the gateway credential is never held on a configuration object, so it cannot surface in a log or a stack trace.
Records and deletion
What an AI employee did stays written down, and what a customer asks us to delete is deleted everywhere it lived.
The decision log is immutable in the database. It refuses to let the application edit or delete an AI employee’s decisions, and a human override is recorded as a new entry.
Reading the record still respects document permissions. Opening the decisions view does not reveal what an AI employee read unless you can open the document yourself.
Memory is tamper-evident. Significant memory events are chained with cryptographic hashes, so a deletion or a back-dated insert can be detected by replaying the chain.
Deletion runs as a durable workflow across database, files, graph, vectors and caches, and reports per store what was verified gone. Anything it cannot prove is reported, not assumed.
Designed to support GDPR erasure and export requests. Every store that holds customer data is part of the deletion inventory.
Bring your security team to the demo.
Bring your CISO, your architect and your hardest questions. In one session we show each of these controls doing its job on documents like yours, and answer what the page cannot.
The same question asked by two people, each answered only from what they could already open.
What happens when an invoice carries instructions, and where the attempt ends up.
What the AI employee did, what it knew, what it was allowed to do and who signed off, replayed as it stood.