The AI answers customers.
It never runs your business.
Billing, permissions, and platform state live in our backend — enforced in code and written to an audit trail — not in a system prompt the model could be talked around. This page is the exact shape of that guarantee: what's isolated, what's verified, and what the agent is never allowed to decide.
One business. One boundary. No leaks.
Every tenant is a single business customer with its own data, its own tools, and its own record. That wall is the product's first promise — and it holds because the database enforces it, not because the code remembers to.
Isolated at the row
One tenant owns one knowledge base, one AI profile, one set of allowed tools, and one audit trail. Row-level rules keep every query inside its own tenant — separation is enforced by the database, not by convention.
Scoped context only
The agent loads only the requesting tenant's documents and connected tools. Content is never merged across tenants — not in retrieval, not in memory, not in a prompt.
Ambiguity stops the line
If a message can't be routed to exactly one tenant, the agent doesn't guess. Routing halts and escalates — and anything still unresolved is quarantined rather than processed.
Nothing runs until the message earns it.
Every inbound event walks the same ordered gate, on every channel. The order is the guarantee: verification, tenant resolution, and idempotency are never skipped, and a step that fails stops the event rather than half-processing it.
- 01
Verify authenticity
Signature, timestamp, and schema are all checked before anything else runs.
- 02
Deduplicate
Retries and repeats are dropped by message, delivery, or event id.
- 03
Resolve the tenant
The event is bound to exactly one business — or it stops and escalates.
- 04
Check policy & entitlement
Plan eligibility and allowed actions are confirmed before any tool can run.
- 05
Load scoped context
Only that tenant's knowledge base and tools are brought into scope.
- 06
Orchestrate
The agent runs its tool and reasoning logic within those boundaries.
- 07
Persist & audit
State and a traceable audit trail are written before anything leaves.
- 08
Deliver
The outbound action is sent through the correct channel adapter.
- 09
Record the outcome
Delivery success or failure is captured, so every action can be replayed.
Powerful where it should be. Powerless where it must be.
The agent is trusted to talk to customers and to retrieve grounded answers. It is never trusted to decide what your business is allowed to do. That line is drawn in code, not in a prompt.
Off-limits by design
The model never decides billing, permissions, or platform state. Those live in the backend and the policy engine — the agent can request an allowed action, never grant one.
Untrusted until validated
User messages and retrieved text are treated as untrusted input. Model output is never assumed to be valid JSON or a safe instruction — it's validated before anything acts on it.
Treated as attacks
Prompt injection, tool injection, and data-exfiltration attempts are handled as security events — logged and contained, not quietly obeyed.
Fail closed
On any security-sensitive path, the system fails closed. When confidence is low or a request is sensitive, it refuses and escalates rather than guessing its way forward.
When sources disagree, precedence decides.
Every answer is grounded against a fixed hierarchy of trust. A lower source can inform a higher one — it can never override it. The model's own memory sits at the bottom on purpose.
- 1
Backend database & audit log
The system of record. What we persisted and logged is final.
- 2
Verified inbound webhook event
A signed, timestamped, schema-checked event from a connected channel.
- 3
Integration metadata
Configuration and state read back from a connected channel or inbox.
- 4
Tenant-scoped retrieval
Answers grounded in that tenant's own knowledge base.
- 5
Model memory or inferred context
The agent's own recollection — useful, but never authoritative.
Rule: lower-priority sources must never override higher-priority ones.
If it happened, it's on the record.
Nothing the agent does is hidden. The events that matter are written down, secrets stay out of the logs, and turning an account off never erases what it did.
A trail for every action
Provisioning, access changes, routing decisions, and automation actions are all logged. Correlation ids thread a single event across every log line so it can be traced and replayed.
Secrets stay server-side
Channel tokens are encrypted at rest and credentials live in environment variables or a secrets manager. Access tokens and secret headers are never written to logs.
Minimal by default in logs
Personal data is redacted in logs where possible. Structured logs capture tenant, channel, and event id for tracing — not a customer's message dumped in the clear.
Suspension preserves history
Suspending an account disables automation and new actions while keeping the full audit history intact — billing changes stay auditable and reversible where possible.
We make no formal compliance-certification claims here — only the concrete guarantees the platform actually enforces.
Answers you can
put your name on.
Isolation, verification, and an audit trail aren't an add-on — they're how every message is handled by default. Connect a channel and see it work. Free for 14 days.