Every tenant is isolated at both the application layer and inside Postgres itself. A bug in one wall can't leak across the other.
Every query is scoped to your org from the authenticated session — never from a client field. Underneath, Postgres row-level security enforces tenant isolation at the database, with a non-superuser role and a per-request app.org_id setting; boot guards refuse to start if it's misconfigured.
The agent observes records/forms, docs, and uploads as untrusted data, never as instructions. Destructive and irreversible actions refuse to run without an explicit, server-checked confirmation step.
The tools to handle data-subject requests and keep your data portable — with your workspace data hosted in the EU.
Admins can export a person's data and erase an individual on request, right from their profile — the tooling you need to support obligations like the GDPR.
On Enterprise workspaces, bring your own AI keys — a direct provider API (Anthropic or OpenAI, including OpenAI-compatible endpoints) or a cloud-hosted Azure OpenAI / Amazon Bedrock deployment — encrypted at rest and never shown back to you or sent anywhere except your chosen provider.
Export records/forms to CSV or PDF at any time, and email a record/form as a PDF straight from the app. No lock-in, no separate reporting copy to drift out of sync.
We publish real architecture facts, not certification logos. If you need a specific framework attestation for procurement, get in touch and we'll tell you where we are.
Tell it what you need in plain language and it builds the forms, rules and workflow. Review, publish, and your crew is capturing in minutes — no consultants required.