Application
Documents, translation, mail, calendar and AI share one organization and account system.
AI and security
AI technology and its security boundary
We do not conflate what AI can do with what AI is allowed to do.
Design premise
Boundaries first, intelligence second
In enterprise software, the first AI question is permissions and side effects, not model choice.
Retrieval
Hybrid vector and keyword retrieval with optional reranking; visibility is filtered in SQL.
Model
All model calls pass a common adapter with retry, circuit breaking, quota and metering.
Permissions
Roles gate entry; content access only follows node ACLs, including AI tools.
Actions
Writes and outbound sends declare their side effect; the full content is shown before human confirmation.
Retrieval
Filter first, rank second
A result counts only if this person is allowed to find it.
- Vector and keyword candidates are combined and optionally reranked.
- Every result carries its source and page so an answer can be checked against the original.
- Mail is indexed only for the mailbox owner; an admin cannot see it.
- Scans need a configured vision model; without one the item is marked “OCR required” instead of silently empty.
AI actions
May read and draft, may not send on its own
Read: as the requester
Every retrieval and tool call carries the requester’s permissions; there is no bypass.
Write: show, then execute
Before writing a document, sending mail or creating an event, the full content goes into a confirmation card.
External content is only data
Mail, documents and MCP results are wrapped and treated as data, not instructions.
Deployment
The enterprise decides where data lives
Private deployment
Run on your own servers, with scripts for backup, restore and upgrade.
Own mail domain
A hosted domain receives after MX and DKIM verification; unverified domains do not receive, and the server is not an open relay.
Tenant isolation
Every enterprise table carries org_id; queries take the organization from the session, never the request body.
Audit
Record actions, not content people should not see
- Admins can read operation and login logs for their own enterprise, bounded by their join time.
- Logs omit mail bodies, subjects and recipients, and omit calendar titles.
- A disabled member immediately becomes a non-member and the session is cleared.
Boundaries
What we do not promise today
These boundaries say more about where the system is than any adjective.
- We do not claim any security compliance grade; if one is obtained, it will be published separately.
- We do not promise a service-level agreement or an uptime percentage; private-deployment hardware and operations are agreed separately.
- We do not describe security as absolute or risk-free; security is a boundary plus verification.
- The built-in order-follow-up expert uses demo MCP data; a real ERP connection is a customization.
Want to verify a boundary?
Bring a specific permission or action question and we will answer with product behavior.
Contact us