What's actually enforced — not a badge to take on faith
Everything on this page is enforced today, in the running product. For anything that isn't yet true, we say so below rather than leave it ambiguous.
Role-based access control
Owner, Admin, Member, and Guest roles. Guests see only the spaces they've been explicitly granted — nothing else in the workspace.
Row-level security
Every table enforces tenant isolation at the Postgres level via RLS policies, not just in application code. A bug in a route handler can't leak another org's rows.
Permission-aware AI
The Irabu Agent and Knowledge Hub search only ever surface what the asking user is already allowed to see — permission checks happen before retrieval, not after.
Append-only audit trail
Every sensitive action — logins, failed logins, role changes, API key creation/revocation, IP allowlist changes — is logged. The log itself is enforced append-only at the database level: not even our own backend can edit or delete an entry.
Source citations on every AI answer
Every AI answer links back to the exact document, file, or record it came from, with a confidence signal, so nothing is a black box.
IP allowlisting
Restrict sign-in and API access to specific networks, opt-in per organization. A fail-safe ensures the workspace owner always keeps access, even if a bad entry is added.
Encrypted in transit
All traffic is served over TLS. API keys are hashed (SHA-256) and never stored in plain text — including in our own database.
Your own database
Each organization's data lives in its own isolated database, not a shared multi-tenant table set.
Compliance status
We haven't completed a SOC 2 audit yet — it's on our roadmap, not something we'll claim before it's true. If your security review requires it, tell us and we'll let you know timing directly rather than leave you guessing. Everything else on this page is enforced in the product today, and you're welcome to verify it during a technical evaluation.
Data handling
We never use your workspace content to train AI models — your content is processed in real time to answer your queries (inference only), never used to fine-tune or update model weights. Full detail on what we collect, why, and how long we keep it is in our Privacy Policy, including a named list of every subprocessor we use.
Reporting a vulnerability
If you find a security issue, email williamfranklyn2020@gmail.com before disclosing it publicly. We take reports seriously and aim to respond within 24 hours.