Trust center
Enterprise buyers ask this page first
The original site has no security page. This one turns engineering discipline into a sales asset.
01
Session → verified membership
An encrypted session cookie is only the start: on every request the user's membership in the organization is verified against the database. Compromised cookies don't grant data access on their own.
02
Row-Level Security in Postgres
The application connects as a role with no bypass privileges. Every query runs inside a transaction that pins the current organization — cross-tenant reads are impossible at the database layer, not just in app code.
03
Agents read freely, write as drafts
Read tools run safely against live data. Every write tool produces a draft that requires an explicit human approval. The approval stream pauses the agent — nothing executes on vibes.
04
Grounded answers, cited sources
Business numbers come from typed tool calls, never from model memory. RAG answers carry citations to the exact source documents.
05
Eval gates in CI
Agent behavior is asserted with a mock model on every push: correct tool selection, grounded answers, writes pause for approval, denials never execute. A regression fails the build.
06
Cost & audit observability
Every LLM call logs tokens, latency and estimated cost per tenant. Every agent action lands in an audit trail with actor and timestamp — available to the customer, not just the vendor.
Subprocessors & deployment
| Component | Role | Note |
|---|---|---|
| LLM inference | Blueprint narrative & agent responses | OpenAI-compatible endpoint; configurable, can be self-hosted |
| Hosting | Web + API | Vercel / Docker — customer's choice |
| Database | Business data with RLS | PostgreSQL 16, managed or on-prem |
Honest boundaries
- · This website is a concept; the demo here is scripted and stores nothing.
- · The blueprint concierge encodes your answers into the URL — no database, no cookies, no analytics. Don’t submit secrets.
- · Certifications (SOC 2, ISO 27001) are a roadmap item presented as such — never implied as held.
- · PDPA (Singapore) alignment is by design: minimal data, purpose limitation, no third-party trackers on this site.