What it can do with your data, and what it cannot.
Mechanisms in the code, and a list of what is missing.
Two directions, and only one has a gate
Every action passes the decision engine first. No path turns a read into a write.
Credentials
Encrypted at rest
BuiltKey outside the database. A copy yields no credential.
No key, no connection
BuiltWithout the key, connecting is refused. Never plain text.
Losing the key is unrecoverable
By designReconnect every source. A recovery path would be another way in.
A refresh token only replaces a refresh token
BuiltA missing value on re-consent leaves the stored one alone.
Read-only is a property of the code, not a checkbox.
Who can do what
| Platform role | Workspace role | |
|---|---|---|
| What it says | Whether someone is OnDuty staff | What someone can do in one workspace |
| Where it applies | Our own administrative surface | Your workspace, only that one |
| Values | Standard, or platform administrator | Owner, admin, operator, analyst, viewer |
| Implies the other | No. | No. |
Or try
operator · 15 permissions · can approve what the gate held
Permission, never role
BuiltRoutes ask for a named permission. Roles map to permissions once.
Unknown resolves to least
BuiltAn unrecognised role string is a viewer, never an owner.
Nobody grants above themselves
BuiltAn admin cannot make an owner. Closed at the service.
A workspace keeps an owner
BuiltThe last owner cannot be removed or demoted.
A record follows its source's sharing
BuiltOnly people the source shares with can read it. Admins read past, logged.
Support access is deliberate
BuiltRead-only, time-limited, with a written reason your owners can see.
Runners on your machines
Registration and its guard are built. Answering from that machine is not.
Two endpoints, and no more
BuiltA runner reaches two routes only; a route-inventory test says so.
The token is hashed and shown once
BuiltLost means reissued, not recovered.
Health is derived from silence
BuiltComputed from when the machine last spoke.
Answering from your machine
Not doneConversations are still processed in our cloud, runner or not.
Where your data sits
Postgres
Environment, not the database · Fernet
Opens the encrypted credential columns.
Every query is scoped by tenant. The credential columns open only with a key kept outside the database.
Every record carries its source, so a conclusion stays traceable.
How we build and run it
Security events are recorded
BuiltRefused sign-ins and staff changes reach the audit log. Addresses are hashed.
Browser access is an allow-list
BuiltOnly our domains call the API from a browser. Wildcards are refused.
Dependencies and secrets are scanned
BuiltEvery change and weekly; updates arrive as reviewed pull requests.
Schema changes are ordered before code
In progressPipeline written, with a person approving. Not switched on yet.
What we have not done
No third-party audit
Not doneNobody outside examined our controls; we do not describe them as certified.
Google verification not yet submitted
PendingTesting mode: only test users connect. The security assessment has not started.
Google Ads and Business Profile access
PendingNeeds a developer token and per-project grants. Neither connector tried yet.
Intuit app review pending
PendingUntil then QuickBooks connects sandbox companies only.
Meta App Review not yet submitted
PendingWhatsApp, Pages, Instagram and Ads work for our accounts, not yours.
Slack and Microsoft Teams apps not yet registered
PendingBuilt, not yet exercised. Slack app uncreated; Teams bot unregistered.
No public API
By designEvery integration goes through a connector we wrote.
Data residency is enterprise-only
PendingArranged per deployment, not a toggle.