Access is checked in the application and again inside the database. If one check ever failed, the other would still keep data from crossing between workspaces.
Every query is limited to your workspace by your signed-in session, never by anything the browser sends. Underneath, the database applies the same limit to every row, using an account that can't switch it off. If that setup is ever wrong, the server refuses to start.
The agent is set up to treat records/forms, documents and uploads as untrusted data, never as instructions. Deleting, emailing a record/form, inviting an admin and changing many records/forms at once happen only after you click to approve, and the server checks that approval.
Your workspace data is hosted in the EU, and you get the tools to answer data subject requests and take your data with you.
Admins can export a person's data or erase it on request, right from their profile. That helps you meet obligations such as the GDPR.
On Enterprise, if you connect your own AI provider, its keys are encrypted at rest, never shown back to you, and sent only to that provider.
Export records/forms to CSV or PDF at any time, or email a record/form as a PDF straight from the app.
We publish real architecture facts, not certification logos. If you need a specific framework attestation for procurement, get in touch and we'll tell you where we are.
Starting is free and needs no card. Describe the first form you need and see what Tebelis builds.