The most valuable list you own deserves better than a promise.
Who you are talking to, what you are being paid and what you have signed is the commercial core of your company. This page is how we treat it — written plainly, without the certificate theatre.
Six rules the system is built around.
Isolation is structural
Workspaces are separated at the data layer, not by a filter in the interface. One tenant cannot reach another tenant’s rows even if something above goes wrong.
Least privilege, re-checked
Rights are granted narrowly and verified against the database on every single request. No permission is ever inferred from a cookie or a cached claim.
Fail closed
When configuration is missing or a check cannot be completed, access is refused rather than assumed. The safe default is "no".
Everything is written down
Every action, approval, change of terms and administrative intervention is recorded with actor, time and context — and the record is exportable.
Privilege is unlisted
Administrative surfaces are not linked from the product and do not acknowledge their own existence to anyone without the right. There is nothing to probe.
Your data is yours
Full export whenever you ask, deletion when you require it, and no commercial use of your partner list or your terms under any circumstances.
What is actually in place.
Separation that does not depend on us being careful.
The strongest guarantee is the one that holds even when something above it misbehaves. Every row of tenant data carries its owner, and the database itself refuses to return rows that do not belong to the caller. An application bug cannot talk its way past that.
Enforced below the application
Policy lives with the data, not in the code path.
No shared read paths
There is no query that returns another tenant’s rows.
Privileged access is deliberate
Elevated operations are explicit, narrow and recorded.
Verified on every request
Rights are re-read, never remembered.
The questions that actually matter.
Who can see your pipeline
Only people you have authorised in your own workspace. Not other tenants, not our commercial staff.
Who can change your floor
Only you. Guardrails are tenant-owned and cannot be relaxed on your behalf.
Who can sign on your behalf
Nobody, while the human signature gate is on — and it is on by default.
What we do with your data
Run your workspace. It is never sold, never shared between tenants, and never used to advantage another customer.
An autonomous system should be easiest to stop.
Every motion, fleet and mandate can be paused instantly, and the irreversible commercial decisions — binding signatures above all — sit behind a human gate that is on by default. Nothing continues because it was already in progress.
Instant pause
One action stops a fleet, a motion or everything.
Hard floors
Below-floor terms are refused, not negotiated down to.
Escalation by default
Anything unusual becomes your decision, with context.
Four steps, in this order, every time.
Detect
Classified security events, continuous review, severity-ranked for action.
Contain
Scoped revocation and isolation without taking your workspace down.
Inform
Direct notification to affected tenants with what is known and what is being done.
Correct
Root cause fixed, control added, and the finding recorded in the trail.
Six things we will never do.
What security reviewers ask us.
Workspace data is isolated at the database layer and access is least-privilege. Operational access is limited to what is necessary to run the service, is logged, and is never used for commercial purposes.