Trust
What we claim, and what we do not.
If you are the person who has to say yes to this, here is the whole picture: the three things you will feel in the first week, where each control actually lives, and the certifications and guarantees we do not have yet. Nothing on this page depends on a model behaving.
01 — Three things you will feel
Price first. Your yes before anything irreversible. A record of everything.
You see the price before every run, and never pay for a failed one
Every priced action shows its estimate before you confirm. The estimate is held, the actual cost is charged when the run finishes — never more than the estimate — and a failed run returns the whole amount, automatically.
Nothing irreversible runs without your yes
Sending, spending and anything that touches the outside world waits at a gate for your click. Approving a plan never approves a gate. A kill switch halts your AI Manager within one tick.
Every action is written to an audit log you can export
One row per action, whether the caller was a button, your AI Manager or an external agent: who, what, on which record, from where, and the result. Filter it, export it as CSV, and nobody — including us — can edit or delete a row.
02 — Where each claim is enforced
Each claim names its mechanism.
Each row names a claim, the mechanism that enforces it, and the layer it lives in.
| Claim | How it is enforced | Layer |
|---|---|---|
| You see the price before it runs. | Every priced action carries a credit estimate and returns it when the job is queued. An action without a price cannot run. The full price table is published to every workspace. | Price table + action manifest |
| You never pay for a failed run. | The estimate is reserved when the job is queued, settled at the actual cost when it finishes — capped at the reserve — and released in full if the run fails. Three database procedures; no other path can move credits. | Database procedures |
| Nothing irreversible runs without your yes. | Every action — a button, your AI Manager or an external agent — goes down one path. Actions are classed safe or confirm, and the server decides whether a confirmation was required; a caller cannot skip it by leaving it out. Gated plan steps wait until you click. | Application choke point |
| The audit log cannot be edited or deleted. | Workspaces hold read-only access; update, delete and truncate are revoked at the grant layer, the platform’s own service role included; a trigger refuses any update or delete that reaches the table. | Database: policy, grants, trigger |
| A bug in one route cannot read another company’s rows. | Row-level security on all 167 tables. The platform’s own bypass was removed, and a build check fails if any policy ever re-grants a cross-workspace read. | Database + CI |
| AI never touches your billing. | Balances are computed by a trigger over an append-only ledger. Reserve, settle and release are database procedures, and a build check keeps every model out of the execution layer that calls them. | Database + CI |
| Secrets never appear in logs, responses or errors. | AI keys and platform tokens are sealed before they reach the database; connector tokens sit in an encrypted per-workspace vault. Only the last four characters are ever displayed. | Application crypto layer |
| Research states nothing it cannot cite. | Web research runs with live search on a grounding-capable model; each report carries the bibliography that pass returned, and a deterministic checker resolves the citations. Your AI Manager’s memos are rejected if they contain a number it was not given or lack citations. | Research pass + verifier + memo check |
03 — Isolation
One company cannot see another.
Every session carries three claims minted by a database hook at sign-in — workspace, partner and role — and every API route fences the workspace before it reads a row. That is the first wall. The second is row-level security on every one of the 167 tables: a query that reaches the database with the wrong workspace returns nothing.
We are not special here. An earlier read-across for the platform owner was removed after a data-bleed incident between two brands, and a build check now fails if any policy brings it back. Partner seats reach only the client workspaces they set up. The service-role client that bypasses row-level security never ships to a browser; a hard guard throws if it is ever run there.
04 — Money
One ledger. Every movement is a row. AI never touches it.
The credit ledger is append-only: one row per movement, no updates, no deletes. Balances are derived by a trigger under a per-workspace lock that refuses a reserve the balance cannot cover, a double charge, a refund without a reserve, and any negative balance. A priced action moves through three database procedures — reserve the estimate when the job is queued, settle the actual cost when it finishes, capped at the reserve, release the whole reserve when a run fails. One job, one reserve, one settle, however many retries it takes; a double click reserves once.
Purchases arrive from our Shopify checkout over a signature-verified webhook and are reconciled nightly, exactly once. A cancelled subscription keeps the credits already granted. Every AI call is itemised on a receipt — provider, model, tokens, cost in cents — and an unknown figure renders as a dash, never as zero.
05 — AI providers and your data
8 providers, our keys, your data.
8 providers sit behind one router — Anthropic, OpenAI, Google, xAI, DeepSeek, Qwen, Moonshot, Z.ai — on keys New Renaissance Labs holds. There are no bring-your-own keys; every usage row and every credit lands on the calling workspace. Keys are decrypted for one call and never persisted or logged. Each prompt is pinned to a model, and there are no fallback models: if a vendor errors, the job fails with the vendor’s own message, the reserve is released, and a fault record notes what was asked for and what ran.
Nothing you connect or upload is used to train anything. Data you connect is ingested by code, not by a model; tokens sit in the encrypted vault; card and bank numbers are never fetched. Scraped web content is treated as data, never as instructions. One retention fact, stated plainly because you will ask: the shaped request and response of every model call are kept in a service-only table for audit and failure diagnosis. No workspace or browser can read it, it carries no key material, and capture can be switched off platform-wide. Provider-side retention follows each vendor’s terms.
06 — Platform security
The baseline, stated as it is.
| Control | State today |
|---|---|
| Sign-in | Email link, Google or Facebook through Supabase Auth. No password fields, no passwords stored; sessions refreshed server-side on every page request. |
| Security headers | HSTS with preload, nosniff, same-origin framing, a strict referrer policy and a permissions policy denying camera, microphone, geolocation and payment — on every path, the API included. |
| Content Security Policy | Report-only, with a written promotion procedure. Not yet enforcing; we say so rather than risk an outage. |
| Cache safety | API responses vary on cookie and authorisation so a CDN never serves one workspace’s response to another. Server errors return a generic body. |
| Rate limits | Per-route throttles on the public surfaces and a per-token limit on MCP — per-instance speed bumps, not a distributed quota. |
| Outbound fetch guard | Every verifier fetch passes an SSRF gate — allow-listed schemes, blocked metadata and private ranges, DNS resolved before connect, re-checked per redirect — that fails closed. |
| Monitoring | Sentry for errors and PostHog for product analytics: ids only, every input masked. Neither receives prompt or response content. |
| Build-time guards | CI runs secret scanning, a lint that no action may bypass the choke point, the cross-workspace tripwire, a model-leak guard and a no-AI check over the execution layer. |
| Self-heal | A deterministic sweep in the database — stuck jobs, error spikes, backlog, silent schedules, hung AI calls — files incidents. Its switch is enforced in the database, not in a prompt. |
| Infrastructure | Next.js on Vercel; Postgres, auth and private file storage on Supabase. TLS in transit; storage encryption per the managed providers’ defaults. |
07 — What we do not claim
What we do not claim.
- No SOC 2 or ISO 27001 report. The controls are real; the attestation has not been procured.
- No published uptime SLA and no status page. A liveness endpoint exists; that is all.
- No MFA or SSO. Sign-in is an email link, Google or Facebook. Enterprise identity is not built.
- Backups follow the managed-database provider’s defaults. A customer-specific schedule, point-in-time-recovery confirmation and a restore drill are not yet scheduled.
- Not everything is enforcing yet. CSP is report-only, rate limits are not distributed, and key rotation is designed (versioned ciphertexts) but has not been exercised.
- Designed to meet, not certified. Human approval of irreversible acts, an audit log that cannot be edited and AI disclosure are built to meet the obligations we can see in AI regulation; nothing is certified against them.
If your sign-off needs any of the above, an engagement with New Renaissance Labs can scope it: identity, backups and restore drills, a private deployment for data residency, CSP promotion, and the evidence pack your auditors will ask for. See /services.
08 — Your data is yours
What you produce, you can take.
Deliverables live in a private bucket; a download resolves the row under your own row-level security, then mints a short-lived signed link. Your business numbers sit in a warehouse you read back by API. CRM contacts, leads, sequences and deals export as CSV. Company Memory exports as a lossless, checksummed archive of everything the company knows — events, entities, relationships, lessons and the situation model — that imports into a fresh workspace and rebuilds itself there. Each report exposes its bibliography under the same rules as the report.
Questions about any of this — or something a counsel or auditor needs in writing — go to /contact. A person answers, and the full reference is on /documentation.
Next step
Bring your counsel to the demo.
A private demo is a real workspace set up for you with credits and an access password. Your counsel can read the audit log, the ledger and the price table before anyone signs anything.