Security is not an enterprise feature

Small businesses hold the same sensitive information as large ones — contracts, payment details, personal data — usually with less protection. Everything here applies on every plan.

🔐

Encryption everywhere

Data is encrypted in transit with TLS and at rest in storage. Personal data is held separately from operational records, so it can be removed without disturbing the rest of your history.

🧾

Tamper-evident history

Document and record history is hash-chained — each entry commits to the one before it, so any alteration is detectable. Verification is available to you, not just to us.

👤

Access control that matches your org

Role-based permissions across every module, with multi-factor authentication and passkey support. The AI assistant respects the same permissions — it cannot surface a record the person asking isn't allowed to see.

🚧

Bounded automation

Every workflow runs inside a spending ceiling and an explicit permission boundary enforced by the platform. An automation cannot reach records outside its lane, regardless of how it is prompted.

💾

Backups and recovery

Automated daily backups with point-in-time recovery. Backups are encrypted and tested — an untested backup is not a backup.

📤

Your data, exportable

Full export of records, documents and audit history in standard formats, any time, without contacting support. Portability is a feature, not a concession.

What we don't claim

Vendors routinely imply certifications they don't hold. We'd rather be direct: where a formal certification or attestation is relevant to your industry, ask us and we'll tell you exactly what we hold today and what is in progress. If a requirement is one we can't meet, we will say so before you sign rather than after you discover it.

Common questions

Where is my data stored?

In the region you select at signup. Data does not move between regions without your instruction, and residency commitments can be written into your agreement on Custom plans.

Is my data used to train AI models?

No. Your documents, records and conversations are not used to train any model, ours or a third party's. They are used to answer your questions and nothing else.

Can we run this on our own infrastructure?

Yes, on Custom plans. The whole platform can be deployed into an environment you control, which is usually the right answer for organisations with strict residency or sector requirements.

What happens to our data if we leave?

You export it — completely, in standard formats, on your own schedule. After a defined retention window we delete our copies and confirm it in writing.

Do you support data-subject requests?

Yes. Access and erasure requests are handled through the platform, and erasure removes personal data irreversibly while leaving the surrounding audit history intact and verifiable.

Who can see our data internally?

Access is limited to the minimum required for support and operations, requires a specific reason, and is logged. We will not open your records because we were curious.