Connecting an AI agent to your business systems is a real decision, and the honest question is not whether data moves — it is exactly where, and what bounds it. This page answers that directly, including the parts most vendors leave out.
Queryables is in beta. We are not carrying a compliance certification yet. Rather than gesture at one, we would rather show you how the system actually works so you can make your own assessment — and talk through anything your review needs.
That is the whole list. There is no analytics vendor, no third-party logging service, and no data broker in the path.
Anthropic and OpenAI, called directly over their APIs. Whatever a step needs to reason about — a prompt, a document excerpt, an email you asked it to draft — is sent to the model handling that step.
Content sent through these APIs is excluded from model training under both providers’ commercial API terms.
A dedicated integration provider holds your OAuth connections and routes calls to your connected apps. It passes the request to Gmail, Drive, Salesforce and the rest, which means the request and its response travel through it.
Access tokens live in the provider’s vault. We store a reference, not your credentials. We’ll name the provider and share its compliance posture on request.
Only if you turn meeting notes on. A recording vendor joins the call, records it, and produces the transcript your agent summarizes.
Recordings stay on the vendor’s infrastructure. Turn the feature off and no vendor is involved.
These are architectural choices, not settings — they hold whether or not anyone configures them correctly.
Most AI tools ingest your files — copying, chunking and embedding them into a vector database they own. We deliberately do not. When you point an agent at a Google Drive folder, Notion space, OneDrive folder, Confluence space, Dropbox or Box location, we store a pointer to it, not its contents. Retrieval reads live from your system at the moment of the question.
Revoke the connection and there is no copy of your documents to delete, because one was never made.
Each agent holds its own connections. The finance agent’s accounting access is not reachable by the marketing agent, even inside the same organization — they are separate identities to every connected app.
One team’s agent cannot read another team’s systems, so a mistake in one place stays in that place.
Every app you connect carries an access level: read-only, read and write, or full access. Read-only means the agent can look and never change anything. The level is enforced when the agent’s tools are assembled, so a read-only connection is not given write tools it could misuse.
You can start an agent read-only, watch what it does, and widen access only once you trust it.
Slack, Teams, Discord and Telegram connect directly through your workspace’s own bot installation rather than through the integration provider. Your team’s messages are not routed through a third-party integration layer to reach the agent.
Chat stays between your workspace and us, with the agent posting under an identity your admins control.
No. We do not train models on your data, and the commercial API terms of both providers we use exclude API content from their training. Your data is processed to answer the request in front of it and nothing more.
It makes the call to the connected app, so it sees the request and the response — the body of an email you asked the agent to send, or the rows returned from a CRM query. It is the standard trade-off for managed OAuth: something has to hold the connection and make the call. Worth knowing rather than discovering later. Messaging channels are the exception and do not go through it.
Yes, with a dedicated model deployment. Both major providers offer private, in-your-cloud hosting where the model runs inside your own infrastructure. It is a six-figure annual commitment and it is the only genuine way to keep content off a shared provider — this is equally true of any AI product, including using the model vendors directly. If that is a requirement for you, talk to us and we will plan around it.
Not yet. We are an early-stage product and we would rather tell you that than imply otherwise. What we can do is show you precisely how data moves, scope an agent as narrowly as you want, and work through your security review with you directly. Several of the controls a formal audit would ask for are already how the system is built; the audit itself is ahead of us.
Disconnecting revokes the OAuth grant, and the agent immediately loses the tools that depended on it. Because we hold pointers rather than copies of your documents, there is no separate store of your files to purge. If you need a full account wipe, contact us and we will handle it directly.
Yes. Every scheduled run is recorded with its status, timing and result, and workflow failures surface rather than being silently swallowed — a step that could not deliver is reported as failed, not completed. If you need a specific audit export for a review, ask us.
Everything is scoped to your organization and then to individual agents within it. Access to an agent is checked on every request against your organization’s membership and assignments. As an early-stage team we do have engineering access to production systems for support and debugging, which we will say plainly rather than leave implied.
Security reviews are a conversation, not a form. Send us what your team needs to know and you will get a straight answer from someone who built it.