Security & trust

Automation you can audit. Data that stays yours.

Trust isn't a badge. It is a set of claims you can check, including the unflattering ones. Below is what we have built, and underneath it, what we have not.

What holds

Six things that are true today.

No aspirations on this list. Each one is enforced by the code today, and you can hold us to it.

Access

Role-based, enforced on the server

Roles rank from Admin to Employee and are checked on the server, not just hidden in the UI. People only see and do what their role allows.

Isolation

Every query scoped to your workspace

Tenant scoping runs on every read and write. Database-level row security policies are written and tested, and we say plainly that they are not switched on yet.

Audit trail

Who, or what, did what, and when

Privileged and automated actions are written to an audit trail, so a decision made last quarter is still accountable this quarter.

Automation

Reversible, never a black box

The coverage agent's actions, like auto-fill, undo with one tap, and every one of them explains the reasoning it acted on.

Compliance

Checked before you publish

Labour rules are versioned, declarative packs. The engine enforces them before a schedule goes out, not after you have already sent it.

Sign-in

No passwords, ever

You sign in with a single-use link that expires in fifteen minutes, or with Google. There is no password to steal, reuse or leak. Enterprise SSO is on the roadmap.

Our posture

What we promise, in six lines.

Not aspirations. These are the rules the code already follows, and the ones we will not quietly break for a feature.

The server is the source of truth. The UI only hides, it never grants.
Every mutating action is authorised by role or ownership.
Granting elevated roles is admin-only, and logged.
Automated decisions explain their reasoning and can be reversed.
Your data is exportable. It is yours, not ours.
Nothing you type is sent to an external AI service. The agent runs on our servers.

What we do not have

The list most security pages leave out.

A security page that only lists strengths is a sales page. These are the gaps, stated before you ask, so nothing here is a surprise later.

No certifications

No SOC 2, no ISO 27001. We have not been audited. Anyone who tells you a young product is certified is either wrong or selling something.

No multi-factor auth

Sign-in is a single-use link or Google. A Google account can carry its own 2FA, which is the closest thing available today.

No penetration test yet

We have not commissioned one. When we do, this line will say who did it and when.

Row-level security is off

The database policies exist and are tested but are not switched on. Your isolation today is application-level scoping on every query, which is real, and we will not describe it as more.

At-rest encryption is the platform's

Traffic is encrypted in transit. At rest, we rely on the hosting platform and add no layer of our own.

No published uptime figure

We have not run long enough for a number to mean anything, so we do not print one.

For the third parties that process data on our behalf, see our list of subprocessors. For the terms on which we process your workers' data on your behalf, see our data processing agreement.

Questions about security?

Ask us anything, including the things this page says we do not have.