Security & Privacy
Permissions you define. Review you can see.
Practical security, agreed in writing: least-privilege access, human approval gates, and honest limits. We do not make absolute guarantees — we build to your risk tolerance and say plainly what depends on your providers.
Our Position
Honest about what is controlled — and what depends on providers.
AI outputs can be wrong. That is why every workflow includes human review, and why suitability, data flows, permissions, and provider limitations are assessed before any rollout.
We do not claim your data never leaves your systems. Connected hosted services process data as part of how they work — what matters is that you decide which services are connected, with what access, and that the decision is written down.
Private or self-hosted deployment is possible only where it is technically appropriate, and it is separately agreed — not a universal default.
What every workflow includes
- Least-privilege access — only what the workflow needs, in systems you approve
- Human approval gates on sensitive actions, agreed before rollout
- Action logs where the connected provider supports them
- Scoped retention and periodic access review, agreed in writing
- Revocation procedures planned up front — capability depends on each provider
Permission Planning
Approval gates are agreed, not assumed.
During planning we map exactly what each workflow may read, what it may prepare, and what requires a person’s approval. By default, workflows do not spend money or send public messages on their own — anything beyond that is an explicit, written agreement.
Permissions are implemented and tested in your approved connected systems. What can be enforced — and how quickly access can be changed — depends on each provider’s capabilities, which we assess with you before rollout.
Workflow May Do
- Read new inquiries in the connected inbox
- Extract request details and dates
- Prepare a draft reply for review
- Search documents you have approved
Requires Human Approval First
- Send the reply
- Update a business record
- Schedule anything external
- Share details with a third party
Not Automatic by Default
- Spending money or making purchases
- Posting public messages
- Accessing systems outside the approved set
Illustrative only. Actual permissions are defined per workflow, agreed in writing, and depend on provider capabilities.
Security Practices
Practical measures, plainly stated.
Least-privilege access
Workflows receive only the minimum permissions required for their function, inside the systems you have approved.
Tested permissions
Permissions are implemented and tested in your approved connected systems before go-live — not assumed on paper.
Human approval gates
Sensitive actions route to a person before they happen. The workflow prepares; you authorize.
Logging where supported
Where a connected provider supports activity logs, actions are recorded for review and correction. Coverage varies by provider.
Scoped retention & access review
What is kept, who can see it, and for how long are agreed in writing and reviewed periodically.
Practical revocation
How access is removed — and how quickly — depends on each provider's capabilities. Procedures are agreed before rollout, not improvised after.
Before you get in touch
- Submitting an inquiry does not authorize any AI processing of your information — it is read by a person.
- Please do not send passwords or confidential business information through the inquiry form.
- Inquiries are used to respond and assess your request — nothing more.
Let’s discuss your security requirements.
A detailed security discussion is part of every first conversation. We’ll be straightforward about what we can and cannot provide.
Discuss your first workflow