Trust
This is what the system enforces by construction, and the limits we already know about — before your questionnaire asks.
Enforced by construction
Every read trims to the person asking inside the query itself, not in code afterwards, so a fact, a summary or a passage you may not see is never assembled and never counted. A caller we cannot identify sees only what is public — never an operator’s view — and nothing a caller puts in a request can widen that.
When the memory writes one sentence out of five documents, only people who may see all five may see that sentence: combining sources can only narrow permissions, never widen them. And where a source’s permissions cannot be read, the connector falls back to a narrower audience — the account that fetched the document — rather than to the firm.
Every citation resolves against the closed set of passages the engine itself put in front of the model, so a reference to a passage that does not exist cannot survive. When you ask a question the model picks from labels the engine maps back rather than naming a location itself, and everything you can click opens a real passage from the evidence gathered under your permissions.
One database schema and one object-store prefix per firm: no shared table holds a customer’s documents, facts or passages. The only tables every firm shares are account, billing and session records, and none of them holds anything the memory learned. Where you want the database itself to hold the line, a firm’s queries can run as a role privileged on nothing but its own schema — required on our hosted service, and available and off by default on a deployment you run, as a second layer behind the schema boundary. A firm whose role is missing is refused, never served on a shared one.
The egress allowlist defaults to the model endpoint and nothing else. There is no telemetry and no update check to switch off, because neither was ever built, and the licence file is informational: nothing is checked against us. Components refuse to start when their configuration contradicts the list, and the network enforcement is your firewall. This applies to a deployment you run, not to the hosted service. Set the list empty and nothing leaves at all, the model included, so nothing new is read; search then ranks by keyword over what has already been read.
Every observation, fact, correction and retraction is an entry on a ledger that is never rewritten — a correction is a new entry, and the old one stays readable. Everything you read on a page is derived from that ledger, and is rebuilt by replaying it rather than repaired in place.
Model credentials are encrypted at rest under your own deployment’s key, one ciphertext per firm, and deleted when the firm is. With single sign-on, the gateway reaches your identity provider and no one else’s. Only extraction and written answers need a model to be reachable — everything already read stays searchable without one.
What we don’t do yet
Administrative actions are recorded and your own administrator can read them: who provisioned a memory, who granted or revoked access, who changed the schema. We also hold a meter of every agent call — which person, in which memory, through which tool, and when — though that one is ours to read and not yet yours. Underneath them, every answer is now logged: who asked, what they asked, and which documents the answer cited, kept for 90 days by default. Some doors sit outside that log: planning a question, saving something an assistant asked it to remember, reading the memory’s vocabulary, the administrative operations, and fetching a stored file directly. A request to a firm that no longer exists cannot be logged at all, because there is nowhere to write it.
The read record and the administrative trail both export as a file for any period, so you can hand an auditor one, and read entries are kept for 90 days by default. What is missing is self-service: the read record has no screen in the console, and on the hosted service we run its export for your administrator on request. On private cloud and self-host, whoever holds the deployment’s operator credential runs it directly.
When a system you connected takes a document away from someone, the next poll notices, and the document leaves that person’s document list within that connector’s interval — five minutes by default. Everything derived from it follows. In the same step, the facts, summaries and passages extracted under the old audience are retracted, so a citation a revoked reader already holds stops opening.
Work already in flight at that moment can briefly cite a revoked document; the next sync of that document repairs it.
This only applies where the source keeps per-document permissions at all: Google Drive, SharePoint and OneDrive, Box, Confluence, Slack and Gmail, and our own drive. A watched folder, Salesforce, HubSpot and Affinity, a Jira project, a Notion workspace and DocuSign are captured with one firm-wide audience, so there is no per-document revocation for us to follow.
We assume every captured document is hostile, and constrain what its text can cause rather than trying to recognise it: nothing it says can widen its source’s permissions or produce a citation outside the passages the engine selected.
We do not ship a classifier that recognises injection attempts, and we do not claim one. Each source also runs in its own process, so the credential that reaches your drive and the untrusted content it brings back are kept apart.
The system is built for a small number of firms with a great deal of material each, and some protections are still written for one process rather than for a fleet: the brake on repeated sign-in attempts keeps its count in memory, so behind more than one instance it brakes per instance.
Destroying a firm drops its schema and its object-store prefix — the ledger, the passages, the facts, the summaries and the search index go with them — deletes its stored credentials, and clears its sessions. What survives is the row saying that firm existed — its name retired and never reusable — the usage records that point at it, the entitlement rows that named who could reach it, left inert rather than removed, and the administrative trail of what was done to it, which we keep on purpose.
Deleting a single document is narrower. The facts, summaries and passages drawn from it are retracted, so nothing derived from it answers a question again. What is not erased is the file's own bytes, the ledger entry recording that we read it, and the prompt text of any work already queued against it — that last one for a few days, until it ages out. The ledger is append-only by design: it is how every answer stays traceable to its source. If you need bytes gone rather than unreachable, destroying the firm is the operation that does it today.
Backups are the exception. A destroyed firm’s data stays inside whatever backups were already taken until your own retention ages them out, and nothing we run reaches into them.
Each pass over a document sends the reader a bounded number of passages. Most documents fit whole. One that does not — a scanned report of several hundred pages — is read up to that bound, and what sits past it is not extracted on that pass. A document that uploaded successfully has not necessarily been understood end to end. We are making this resumable so every passage is read exactly once; until then, assume a very long document is covered at its start rather than throughout.
What a citation does not establish is that the passage supports the sentence. The model chooses which real passage each sentence carries, and it can choose one that does not paraphrase it. The check a reader has is the one we built the citation for: open it and see. We are adding automatic checks for figures, periods and currencies, which will withhold a claim rather than show it unverified.
This list is what we know about. If your review finds something it does not name, tell us and we will add it here.
Questions about security?
Questions on access, deployment or anything above — write to us.
The paperwork, in the meantime: our data processing agreement, and the sub-processors we use to run the service.