Security
The database is the boundary.
Permissions are not an application-layer feature. They are rows, policies and tests in Postgres, and the browser cannot write.
| Tenancy | Every table carries the org id. Row-level security is enabled and forced on all of them. A check in continuous integration fails the build if a new table forgets. |
| Writes | The browser cannot write. Every change is a server action that re-checks the actor inside Postgres. The absence of write policies is the write boundary. |
| Identity | Your identity provider: Google Workspace, Microsoft Entra, Okta, or any SAML or OIDC provider. Domain claims are validated server-side. Contractors are invite-only. |
| Visibility | Managers see their team subtree and nothing else. A rep sees themselves. Proven by an automated cross-tenant test on every release. |
| Vendor access | Support accounts are scoped to your tenant by the same rules. A platform administrator cannot see another tenant's rows. |
| Recordings | Private storage, short-lived signed links, no public URLs. Audio 90 days, transcripts 2 years, compliance flags 7 years. All configurable per tenant. |
| Assistant | Retrieval runs as the asker. Sources are data, not instructions. The model has no write tools. Chat retention from 30 to 730 days. |
| Models and voice | Named sub-processors. No training on your data. Data-processing agreement available. |
| Testing | Schema and security model validated against real Postgres on every migration: 46 tables, all with row-level security forced, and 36 automated assertions covering visibility, scoring, mastery, gating and assistant safety. |
Request the security overviewThe overview covers architecture, retention, sub-processors and the test suite. Ask for it in the working session.