Security
Read-only by default.
The platform is built by someone whose day job is AI model risk at a major bank, and it behaves that way: read first, propose, wait for a person, record everything, replay anything.
Read-only
What runs read-only.
- Every connector declares its capability as read, propose or act, and starts as read. Dry run is the default. Rate limits are enforced by the registry. Health states are ok, degraded, needs_human, down and not_configured.
- POS, bank and card, payroll, supplier, accounting, reservation, delivery and review connections produce evidence with hashes and coverage. There is no transfer, payment or account-number endpoint anywhere in the system.
Approval
What requires a person.
- Posting journals, paying bills, moving money, changing vendor banking, placing orders, changing approved substitutions, filing taxes and acting on employee allegations always require a person.
- Recipe and supplier master commits require a current policy binding the exact base hash. Changed allergens or units never pass the routine path.
- Owner-only proposals never execute on their own. An action in the act class is never a learner arm. A kill switch disables all proposals.
Receipts
Receipts are the record of truth.
- Every external-facing intent carries a sha256 idempotency key. Receipts are write-once, never rewritten, never deleted. A pending marker survives a crash so nothing is retried blindly.
- Every executed operation produces an execution receipt binding the operation, work item, decision, authorization, actor, output hash and measured resource use.
- Event streams are append-only and hash-chained; learning updates travel through an encrypted outbox and are applied exactly once.
The workspace
A private workspace.
- The evidence store is content-addressed (sha256), write-once, never deleted by the program, and re-hashed on every read.
- One PII scrubber sits at the store boundary. Employees are pseudonymized with HMAC-SHA256 tenant keys. No guest node exists. Forbidden-pattern scans for emails, phones, SSNs, card numbers, tokens and paths run on every publish.
- The local context graph is encrypted with AES-GCM under DPAPI-wrapped keys. Read-only SQL is parameterized: one SELECT, no DDL, no file functions.
Boundaries
What never leaves it.
- Raw bank, guest and employee rows never reach a model. Calls carry approved aggregates only.
- Your data is never used to train shared models. Models adapted to your sales are yours. Owner preferences are never pooled.
MFA
MFA is yours.
- Bank and card feeds come through Plaid, so the platform never holds your bank login. POS, payroll, supplier, accounting, reservation and review connections are authorized by you through each provider. The platform stores no credentials, never bypasses MFA, CAPTCHA or a lockout, and answers all three with “manual login required”.
Hosted plans
Designed on Cloudflare, opening by invitation.
- Hosted plans are designed on Cloudflare (DNS, WAF, Access, Pages, Workers, Queues, R2) with managed Postgres under row-level security, per-tenant keys, point-in-time backups and weekly restore drills. The read-only tenant API uses bearer tokens stored as SHA256 hashes, owner and read-only roles, and has no mutation endpoints.
- Certifications: SOC 2 is on the roadmap for hosted plans. No badge appears on this site until it is held.