Security
Security and data handling in the private alpha
This page lists the controls the product has today and the commitments it does not make yet.
What the product does today
Separate workspaces
Each customer workspace is a separate container for context, sources, claims, insights and actions. Requests are checked against organisation membership, and the database tables use row-level security.
Provider keys stay on the server
Retrieval and model provider keys are held on the server. Keys saved in a workspace are encrypted at rest (AES-256-GCM) and only a short hint is shown back.
Human approval
Insights and actions are reviewed by a person before they are reused or exported.
Guarded page fetching
Monitor fetches public web pages only. Private, local and link-local addresses are refused, each redirect is checked again, and response size and time are capped.
Scraped pages are data
A page that contains instruction-like text is excluded from analysis and flagged. Model output that cites an ID that does not exist is rejected.
Versioned lineage
Each run records the context version it used and the queries behind its sources.
Analytics boundary
Marketing analytics on this site never receive research goals, sources, claims, insights, actions, Ask content or form free text.
What is not claimed
- No compliance certifications or audit reports are claimed.
- No uptime, SLA or support-response commitments are made.
- Enterprise governance, SSO and advanced admin controls are later capabilities.
- Data-residency options are not defined yet.
Questions from prospective design partners are welcome after you join the waitlist.
Join the private alpha waitlist
Access opens in batches. Leave your email and you will be told when your spot opens.