Trust & Security
Autonomy you can audit.
The Engine runs companies with AI managers and AI workforces. That only works if the governance lives in the database, not in the prompt. Here is what the platform enforces, where each control lives, and what we do not yet claim — written for the people who sign off on it.
01 — Claims and where they are enforced
Each claim names its mechanism.
Each row names a claim, the mechanism that enforces it, and the layer it lives in. None depends on a model behaving.
| Claim | How it is enforced | Layer |
|---|---|---|
| Nothing irreversible runs without a human yes. | Every mutation — button, in-app manager or external agent — passes through one action registry. Actions are classed safe or confirm, and the server decides whether a confirmation was required; a caller cannot skip it by omission. Gated plan steps park until an owner clicks. | Application choke point |
| The audit trail cannot be edited or deleted. | Tenants hold read-only access; update, delete and truncate are revoked at the grant layer, the platform’s own service role included; a trigger refuses any update or delete that reaches the table. | Database: policy, grants, trigger |
| A bug in one route cannot read another tenant’s rows. | Row-level security on all 167 tables, 183 policies. The root bypass was removed; a CI tripwire fails the build if a tenant policy ever re-grants cross-workspace reads. | Database + CI |
| No language model touches money. | Balances are materialised by a trigger over an append-only ledger. Reserve, settle and release are three database procedures; settle is clamped at the reserve. The zero-AI execution layer is enforced by a build check. | Database + CI |
| You see the price before it runs. | The full price table is published to every tenant; every action carries a credit estimate in its manifest and returns it when the job is queued. An action without a price cannot run. | Price table + registry manifest |
| Research states nothing it cannot cite. | Web research runs with live search on a grounding-capable model; each report carries the bibliography that pass returned, and a deterministic checker resolves the citations (advisory). The AI manager’s memos are linted: an unsupplied number or a memo without citations is rejected. | Research pass + verifier + memo linter |
| Secrets never appear in logs, responses or errors. | AI keys and platform tokens are sealed with a libsodium sealed box before they reach the database; connector tokens sit in a per-workspace AES-GCM envelope vault. Only the last four characters are ever displayed. | Application crypto layer |
| Event logs carry no payloads. | The system-event spine records sizes, counts, ids, model names and timings — never prompt or response text. Full payload capture is a separate, service-only table with a kill switch, described under AI providers and data. | Observability layer |
02 — Tenant isolation
Claims are the first wall. Row-level security is the second.
Every session carries three claims minted by a database hook at sign-in — workspace, partner and role — and the hook honours a requested workspace only when a membership, the root flag or a partner seat over that workspace backs it. Every API route declares its authorisation level and fences the workspace before it reads a row. That is the first wall. The second is Postgres row-level security on all 167 tables, 183 policies: a query that reaches the database with the wrong workspace returns nothing. Money tables are tenant-read-only; due-diligence reports are need-to-know.
The platform owner is not special here. An earlier root read-across through RLS was removed after a cross-brand data-bleed incident, and a CI tripwire now fails the build if any policy reintroduces it. Root sees only its active workspace through row-level security — balances, the credit ledger and memberships excepted. The cross-tenant surface is the admin plane: explicit, audited service-role paths that answer not-found, never forbidden, to anyone who is not root. Partner seats reach across the client workspaces they provisioned — the designed reach of a reseller, pinned to the partner id in their own token. The service-role client that bypasses RLS never ships to a browser; a hard guard throws if it is ever executed client-side.
03 — Money
One ledger. Zero AI. Every movement is a row.
The credit ledger is append-only: one row per movement, no updates, no deletes. Ten kinds of movement exist — grant, gift, purchase, reserve, settle, release, refund, rollover-expire, wholesale grant and game reward — and nothing else can be written. Balances are derived by a trigger under a per-workspace row lock that refuses a reserve the balance cannot cover, a double settle, a release without a reserve and any negative balance.
A metered action moves through three database procedures. Reserve takes the estimate when the job is queued. Settle charges the actual units, clamped at the reserve. Release returns the full reserve when a run fails. One job, one reserve, one settle — however many retries it takes. A unique constraint on kind and reference makes a duplicate webhook a no-op; a server-derived idempotency key means a double click reserves once. A per-workspace ceiling caps concurrent jobs.
Purchases arrive from Shopify over a webhook verified on the raw body with a timing-safe HMAC; an unverified request is never acknowledged, and a nightly reconcile grants any paid order whose ledger row is missing, exactly once. A cancelled subscription keeps the credits already granted. Every AI call is itemised on a receipt — provider, model, tokens, cost in cents — and an unknown figure renders as a dash, never as zero.
Actual above reserve is never charged to the tenant. Settle clamps at the reserve; the overrun is absorbed by the platform and logged.
04 — Auditability
Every action leaves a row you can export.
The registry writes one audit row per invocation — identical whether the caller was a button, the AI manager or an external agent over MCP. Each row carries the actor (a user id, or brain, worker or system), the action, the target, the source (route, agent or MCP), the result (ok, or the error class) and a reference that threads plan steps together. Owners filter by actor, action, date and reference and export as CSV. The cross-tenant viewer is root-only and still reads through the user client — the database, not the route, is the wall. No purge is wired: audit deletion stays human-reviewed.
What you produce is yours to take. Deliverables live in a private bucket; a download resolves the row under your RLS, then mints a short-lived signed URL. Business numbers upload as CSV into a warehouse you read back by API; CRM contacts, leads, sequences and deals export through a confirm-class action. Company Memory exports as a Mind File: a lossless, checksummed archive of events, entities, edges, lessons and situation that imports into a fresh workspace and rebuilds its derived layers. Each report exposes its bibliography under the same RLS as the report.
05 — Compliance features
Compliance is a gate, not a checkbox.
Each control is enforced at the point of action — the order handler, the send path or the database — rather than in a policy document. Preview marks a surface that is built and enabled per workspace.
Purpose-gated investigation
Reports on people need one of three allowed commercial purposes; employment, tenancy, consumer credit, insurance and licensing are refused server-side. The attestation is logged verbatim; a velocity ceiling holds unusual volumes for review; three jurisdiction modes set the scope.
Public sources only
Person reports draw on live, lawfully accessible public web sources — no credit-header, consumer-credit, GLBA or DPPA data, no sealed or expunged records. Counsel-finalised disclaimers render verbatim and cannot be edited.
Correction and suppression
A public correction and suppression channel for report subjects — unauthenticated, rate-limited, reviewed by a human — with 5-day acknowledge and 30-day resolve targets.
Unsubscribe on outreach
Mail from your own mailbox carries a sender-identity footer, a one-click unsubscribe link and the List-Unsubscribe header. One unsubscribe suppresses the address across every campaign; bounces are never re-targeted.
Consent-gated broadcasts
PreviewBroadcasts send only to recorded consent, check a suppression list that fails closed, carry RFC 8058 one-click headers, and pause themselves when bounces or complaints climb.
Do-not-call and disclosure
Call tasks are checked against the do-not-call list before they queue; an unreadable list means no. The seeded voice persona must say it is an AI assistant at the start of a call and honour an opt-out. The Engine places no calls; both serve a telephony worker you supply.
Chatbot boundaries
PreviewA public chatbot is framed as the company’s assistant: no orders, payments or promises; blocked topics refused before any model runs; no web search, no invented answers; no credits, no model call.
Marketplaces on their own terms
Classifieds marketplaces that forbid automated posting are served in assisted or kit mode: the platform drafts and prefills; a human clicks post.
Legal drafts that say what they are
Every legal document carries a non-removable disclaimer in the body, the PDF footer and on screen; the governing jurisdiction is mandatory; nothing is signed, filed or sent.
06 — AI providers and data
8 providers, our keys, your data.
8 providers sit behind one router — Anthropic, OpenAI, Google, xAI, DeepSeek, Qwen, Moonshot, Z.ai — on keys New Renaissance Labs holds. No bring-your-own keys; the key source is shared, but every usage row and every credit lands on the calling workspace. Keys are decrypted just-in-time for one call and never persisted or logged. Each prompt is pinned to a model — per prompt, then per operation, then global — and a capability matrix strips any parameter a model does not support. There are no fallback models. If a vendor errors, the job fails with the vendor’s own message, the reserve is released, and a fault ledger records what was asked for and what ran.
Data you connect is ingested by code, not by a model: connector sync is a zero-AI path, tokens sit in the envelope vault, and card and bank numbers are never fetched. Nothing you connect is used to train anything. Scraped web content is treated as data, never as instructions. One retention fact, stated plainly because a risk partner will ask: the shaped request and response of every model call are retained in a service-only table for audit and deterministic failure diagnosis. No tenant or browser can read it, it carries no key material, and capture can be switched off platform-wide. Provider-side retention is governed by each vendor’s terms.
07 — Platform security
The baseline, stated as it is.
| Control | State today |
|---|---|
| Security headers | HSTS with preload, nosniff, same-origin framing, a strict referrer policy and a permissions policy denying camera, microphone, geolocation and payment — on every path, the API included. |
| Content Security Policy | Report-only, with a written promotion procedure. Not yet enforcing; we say so rather than risk an outage. |
| Tenant cache safety | API responses vary on cookie and authorisation so a CDN never serves one tenant’s response to another. Server errors return a generic body. |
| Rate limits | Per-route throttles on public chat, data rooms, the correction channel, agent chat and autofill, plus a per-token limit on MCP — per-instance speed bumps, not a distributed quota. |
| Outbound fetch guard | Every verifier fetch passes an SSRF gate — allow-listed schemes, blocked metadata hosts, private and link-local ranges, DNS resolved before connect, re-checked per redirect — that fails closed. |
| Sign-in | Email magic link, Google or Facebook through Supabase Auth. No password fields, no passwords stored; sessions refreshed server-side on every page request. |
| MFA / SSO | Not built. Enterprise identity — SAML, SSO, MFA — is available as an engineering engagement. |
| Monitoring | Sentry for errors (production only) and PostHog for product analytics: ids only, every input masked in session replay. Neither receives prompt or response content. |
| Build-time guards | CI runs secret scanning, a registry lint (no mutation may bypass the choke point), the root-scope tripwire, a model-leak guard, a brand-leak scan and a zero-AI check over the execution workflows. |
| Self-heal sentinel | A deterministic 14-check sweep in the database — stuck jobs, error spikes, backlog, cron silence, hung AI calls — files incidents. Its switch is enforced in the database, not in a prompt; the sentinel that calls it is a scheduled task outside the app. |
| Infrastructure | Next.js on Vercel; Postgres, auth and private file storage on Supabase. TLS with HSTS preload in transit; storage encryption per the managed providers’ defaults. |
08 — What we do not claim
What we do not claim.
- No SOC 2 or ISO 27001 report. The controls are real; the attestation is not yet procured.
- No published uptime SLA and no status page. A liveness endpoint exists; that is all.
- Backups follow the managed-database provider’s defaults. A customer-specific schedule, point-in-time-recovery confirmation and a restore drill are not yet scheduled.
- Not everything is enforcing yet. CSP is report-only, rate limits are not distributed, and key rotation is designed (versioned ciphertexts) but has not been exercised.
- Designed to meet, not certified. Human approval of irreversible acts, an immutable audit trail and AI disclosure are built to meet the obligations we can see in AI regulation; nothing is certified against them.
If your mandate needs any of the above, the enterprise engagement scopes it: identity, backups and restore drills, data residency on a private deployment, CSP promotion, and the evidence pack your auditors will ask for.
Next step
Bring your counsel to the demo.
A private demo is a real workspace, provisioned with credits and an access password. Your counsel can read the audit trail, the ledger and the price table before anyone signs anything.