Workspaces are kept apart
Every workspace's data is separated in the database itself (row-level security), and stored files are encrypted with a key per workspace. People reach only the workspaces they are members of, with the rights of their role.
Everything is recorded
Every change is written to an append-only audit log whose hash chain can be verified. Sign-ins, refused requests and changes to who may do what go to a separate security log. Owners run access reviews of members, tokens, connected apps and data rooms.
Your data stays yours
- An owner can export a whole workspace at any time in open formats (JSON Lines and CSV, with every file and the audit log).
- Workspaces set how long by-product data, such as assistant conversations, is kept.
- An owner can erase a workspace after a grace period; its keys are destroyed first. People can erase their own account.
The assistant is transparent and supervised
- Answers written by an AI model are labelled as AI-generated, and each one keeps a record of the model, prompt version, tools and figures it used.
- The assistant reads figures and creates drafts; a person approves. It is not built to make decisions about people, such as credit scoring.
- Owners choose the AI provider and model, set budgets, and can roll back to an earlier assistant version.
The public guide
The guide agent on this site answers from published content with full-text search, not with an AI model. It has no access to any workspace and keeps no conversation; its logs record what it pointed to, not the question asked.