Built on zero trust.
Written down in plain English.
No agent is trusted because of where it runs. Every one proves who it is on every call, reads only what it's allowed to, and leaves a record only it can write. Below is every control, what it does, and how far it's been verified.
Six rules the whole platform is built on.
Isolation is the default
Every customer has a separate runtime, data store, identity gate, network and workspace. There is no shared database to leak from.
Prove it on every call
Agents never trust each other by location. Each call carries a short-lived, single-use ticket for one caller and one route.
One writer per record
Every log and data file has exactly one identity allowed to write it, enforced by the operating system, not by convention.
People approve what leaves
Agents prepare and flag. Anything sent outside your business, and every release to your instance, needs a named human approval.
Never invent
No agent may claim an action it didn't take or a fact it can't support. Answers that fail the check are held back.
Private models only
Models run on infrastructure we operate and are drawn only from approved Western developers. Your data never goes to a public AI service.
What protects your instance.
| Control | What it does | How it's enforced |
|---|---|---|
| Tenant isolation | Your agents can't reach another customer's, and theirs can't reach yours | Separate networks per instance; agent ports bound to the host only; tested from inside each instance |
| Agent identity | Every agent holds only its own credential | One credential file per agent, readable only by that service; credentials rotated, never shared |
| Call tickets | Each request between agents is authorised individually | Single-use, 60-second tickets checked by the instance's identity gate; every decision logged |
| Least privilege | Agents read only the records their job needs | Per-agent scopes; read-only tools; every agent runs as its own non-root user |
| Model protection | Instances can use models but can't change or delete them | A filter in front of the model host allows inference only; direct paths are firewalled |
| Upload scanning | Files are checked before anyone or anything opens them | Every upload is virus-scanned; if the scanner is down, uploads are refused, never waved through |
| Sign-in | Each person signs in separately, with owner and staff roles | Per-person sessions; one-time setup links; staff confined to staff views |
| Audit trail | Every line in every log has a provable author | One writer per log file, enforced by file ownership; a read-only guardian auditor per instance |
| Alerting | Attacks and failures surface quickly | Denied calls, failed sign-ins, scanner hits and a stopped gate raise an alert within minutes |
| Release control | Code changes can't reach you unannounced | Your instance runs a pinned release; moving it needs a named approval and a data backup first |
| Recovery | A workspace can be rebuilt after a failure | Scripted rebuild from backup with data verified byte-for-byte; a rehearsed incident plan |
Where it lives and who can touch it.
Short answers to the questions every owner asks.
Where is my data stored?
In your own instance, on servers we operate in the United States. [Confirm region after the cloud move]
Is my data used to train AI?
No. Models run privately for us and nothing you send is used to train any model or sent to a public AI service.
Can your staff read my data?
Our own monitoring sees health and counts, not your records. [Confirm once platform agents are fully walled off from customer data, and state the support-access policy]
What happens to my data if I leave?
[Export format and deletion timeline]
Who can see what inside my business?
Each person's conversations, memory and uploads are their own. Owners manage people and roles; staff can't see owner-only views.
We'll tell you what's proven and what isn't yet.
Security claims without evidence are marketing. Here is where each one stands.
Isolation, tickets, scanning, alerting
Each control has an automated check that is itself proven to fail when the control is removed.
Independent penetration test
[Firm and date: before the first paying customer]
Formal certifications
We don't hold SOC 2 or ISO 27001 today. [Roadmap, if any]
Bring your security questions to the demo.
We'll show you the controls working on a live instance, including the ones that refuse.