# Security, privacy and AI transparency

> How workspaces are kept apart, what is logged, how data is exported and erased, and how the assistant's answers stay transparent and under human oversight.

## Workspaces are kept apart

Every workspace's data is separated in the database itself (row-level security), and stored files are encrypted
with a key per workspace. People reach only the workspaces they are members of, with the rights of their role.

## Everything is recorded

Every change is written to an append-only audit log whose hash chain can be verified. Sign-ins, refused requests
and changes to who may do what go to a separate security log. Owners run access reviews of members, tokens,
connected apps and data rooms.

## Your data stays yours

- An owner can export a whole workspace at any time in open formats (JSON Lines and CSV, with every file and the
  audit log).
- Workspaces set how long by-product data, such as assistant conversations, is kept.
- An owner can erase a workspace after a grace period; its keys are destroyed first. People can erase their own
  account.

## The assistant is transparent and supervised

- Answers written by an AI model are labelled as AI-generated, and each one keeps a record of the model, prompt
  version, tools and figures it used.
- The assistant reads figures and creates drafts; a person approves. It is not built to make decisions about people,
  such as credit scoring.
- Owners choose the AI provider and model, set budgets, and can roll back to an earlier assistant version.

## The public guide

The guide agent on this site answers from published content with full-text search, not with an AI model. It has
no access to any workspace and keeps no conversation; its logs record what it pointed to, not the question asked.