Isolation is the foundation
Tenancy is not a feature layered on later. Separation between organizations and workspaces runs through the data model, enforced at the database row level rather than in application code that can be bypassed.
Security
What we enforce, and what we don't claim
You are evaluating a governance product. The fastest way to lose your trust would be to overstate the governance, so this page does both halves.
What is enforced today
Roughly eight checks on every answer
A single recall passes through a stack of authorization filters before anything is returned. They apply to every query on every route — the connection protocol, chat, and the API alike.
Keys are scoped, not universal
An API key is bound to a workspace and to a set of capabilities. A key that can read cannot necessarily write, and a key for one workspace cannot reach another.
Every recall is logged
Query logs, security events, and a citation graph record what was surfaced and when. For anyone who has to answer "what did the AI see", that record exists.
Content passes review before it is recallable
Ingested material moves through an approval path rather than becoming instantly retrievable, so what reaches a model is what someone accepted.
Governance surfaces are built
Audience access, sensitivity labels, retention rules, policies, service accounts and a governance log are built front and back. They sit behind flags that default to off while we finish testing — a go-live decision, not a build decision.
The other half
What we don’t claim
Most security pages are a list of everything that sounds reassuring. This is the list of things we could write and won’t, because they are not true yet.
We are not certified against any compliance framework
No audit has been completed. If your procurement process requires one, we are not there yet and would rather tell you now than in week six.
We log what was returned, not what was used
We can tell you exactly what was surfaced to a model. We cannot yet tell you which parts it actually relied on when it answered.
We cannot tell you who wrote a piece of content
Our own pipeline generates text and files it the same way as text a person typed. Any claim that we can separate human-written from model-written material would be false today.
Shared connectors do not track later edits
Once a document is brought in from a shared source, edits made upstream afterwards do not currently flow through. Personal connections do handle this.
Deletion timelines are not automated yet
Retention rules exist as a surface. The automated enforcement behind them is not running, so we will not put a number of hours on it.
Working through a security questionnaire? Send it over — we will answer it as plainly as this page.