Don’t trust us. Audit us.
You would be asked to connect a system to your firm’s email and documents, by a company you had not heard of last week. That is a real risk and we are not going to argue you out of it. What follows is what the architecture actually does, what we do not yet have, and what you can verify yourself.
Accurate as of 30 July 2026. If something here stops being true we change this page, not the conversation.
The controls, each with the thing you can check.
Access is granted and revoked by you
Connections to your systems are provisioned by your own administrator inside your own tenant, using your own identity provider. Revocation happens in your console and takes effect immediately. We hold no standing credential that survives your revoking it.
Revoke in your admin console and watch the next call fail.
Permissions are enforced before generation, not after
Every retrieval carries the caller’s scope into the SQL query itself. Out-of-scope rows are never selected, so there is no filtered-out content sitting in a context window waiting to leak. On our benchmark this produced zero permission leaks against a conventional baseline’s one.
Ask for the eval artifact. It is version-pinned and we will send the file.
One isolated stack per customer
Each customer gets a separate database and a separate container stack. There is no shared table with a tenant column. A cross-customer query is not forbidden by policy — it has no path to execute.
Architecture walkthrough on a call, including the compose files.
It runs where you choose
Our infrastructure, a server in your jurisdiction, or hardware you own. For strict residency the whole pipeline can run on local models, at a cost to answer quality we will quantify for you rather than hide.
Named deployment target written into the agreement.
Your knowledge is files you own
The source of truth is markdown in a git repository — one file per fact, provenance in the front matter, every change a commit. You can clone it, diff it, and keep it if you leave. The serving database is a disposable projection rebuilt from those files.
Read the repository. That is the whole verification.
Every access is logged, and the log is yours
An append-only record of every call: who asked, with which key, at what scope, which sources were returned, and which were withheld. It is written to your record layer, not to a dashboard we control.
Open the log file. It is in the same repository.
Untrusted content is quarantined before a model sees it
Content arriving from low-authority sources is classified and rejected at a deterministic boundary ahead of any model call, so a prompt-injection attempt in an inbound document does not reach a context window at all.
We will show you the quarantine test in the suite.
Agents propose; your people approve
Consequential steps compile as drafts with a named approver and an approval packet. Nothing irreversible commits without a human, until you explicitly relax that for a specific skill.
Approval packets are in the record layer with the decision attached.
Your data trains nothing
Zero-retention terms with our model providers, and no training on your content by us or by them. This goes in the contract rather than on a page.
Read the clause before you sign anything.
What we do not have.
- No SOC 2, no ISO 27001, no third-party penetration test. We can describe controls and walk you through the architecture; we cannot show you a badge, and we will not imply one.
- No production deployment. Zero customers — you would be the first, and the first deployment will find things this page does not anticipate.
- No live mailbox or chat connector yet. Everything today reads from file adapters, so the first integration is work we would do with you rather than switch on.
- Tested to 3,000 documents. Not 300,000. We do not know where it degrades.
- No formal incident-response process, because there has been nothing to respond to. We would write one with you before any production data moves.
- No bug bounty and no published subprocessor list yet. Ask and we will tell you exactly which providers are in the path for your configuration.
Paperwork.
- Data processing agreement
- Available on request. Reviewed by your counsel, not ours.
- Model terms
- Zero-retention, no-training, named providers.
- Security brief
- One page, plain language, written for a partner rather than a CISO.
- Deletion
- Say the word and the stack is destroyed. You keep the repository.