A number you cannot trace is a rumour with a decimal point.

Read-only credentials, scoped per department to the specific tables, endpoints or exports each one needs. The permitted calls are declared up front and enforced by the runtime rather than by convention. No connector may declare a write scope, and a write is refused before the request leaves.

Records are read at query time and used to compose the answer. Source data is not copied into a warehouse or used to train models. Documents you choose to upload or sync are the exception: they are held, in passages, so they can be searched, and each is filed under one department on the way in.

Each question is recorded on our side (what was asked, which departments answered, what it cost and how many of its figures verified) and you can look back over that record for the audit-trail period of your plan. The answer itself, with the record id behind every figure, stays with the person who asked it and exports to a file, so every figure can be traced to its source without us holding your records.

While a conversation is under way, each department keeps what it read for 24 hours after the last question, so a follow-up does not read everything again; then it is deleted. Each department also keeps short notes on how your company works (below): never figures, names or records.

As your company uses the product, each department learns it: how it counts things, where its figures live, which queries and reports worked and which did not, and how you like answers set out. Corrections a person makes to an answer are learned too, and so is what the documents you file into each department show about how you work. A note drawn from a document leaves when that document is deleted or moved, and nothing is learned from your website's pages.

What is kept is short notes of that kind, for your company only. Never figures, names or records: those are always read fresh from your systems and cited. Notes apply automatically, and an admin can switch learning off on the Company page. Notes are deleted with the company. On by default, on every plan.

Three companies process your data on our behalf. Anthropic’s models read the records and passages a question reaches, and the notes its departments have learned, to compose the answer and, where an admin has turned Business context on, to run a department’s web searches, receiving the words of the search and nothing of your records.

Voyage AI receives the text of documents you chose to upload or sync, and the phrase a department searches them with, to produce the embeddings that make search by meaning work. When a department's expert methods are being chosen, it also receives their published descriptions and short descriptions of what that department could not answer, kept only when they contain no figure, date, name or record. It does not receive connector data, ledger rows, HR records or answers.

The product chooses which published expert methods each department uses for your company, and keeps that choice; to make it, it asks a decision model, Jev by TypeSafe. For that, TypeSafe receives the published name and description of each method being considered, your kind of business, each department’s name and description, and the kinds of system you have connected (for example “a CRM”, never the vendor or the account), and never your company’s name, a question, an answer, a learned note or any record. The same request, with the published name and description of each standard business term instead of methods, decides which of those terms (such as “order” or “stock on hand”) your departments are likely to use.

To choose which Anthropic model answers each part of a question, TypeSafe receives the question as restated for answering, each department’s part of it and the department names. Those can hold a name you typed or one carried over from an earlier answer, so they may contain personal information; TypeSafe is never sent an answer.

Where an admin has turned Business context on, TypeSafe also checks a department’s web search before it runs, and receives the department’s name and description, its part of the question and the words of the search. The department writes the search, so it may name your company or a person. Where a deployment reorders search results, TypeSafe also receives the phrase a department searched your documents with and the passages that search found, with their file names, and returns a score for each, so the passage that answers is read first.

The methods come only from Anthropic and named vendor partners, and are reviewed and pinned by us before they reach anyone. A public page a department reads is fetched as anyone fetches it: no credential, no scripts, and never an address inside a private network. The full sub-processor list, including hosting, is in the security pack.

Two separate axes. An access role (viewer, member, admin) decides what a person may change. A business title decides which departments a department may read on their behalf. Neither is something a person can set for themselves, and both are re-checked behind every endpoint, so calling the API directly gets the same refusal the interface implied.

Every request is resolved to one company before anything is read, and every query is scoped by it: connectors, documents, definitions, spend and people alike. There is no query in the system that could be scoped by something else and reach across. The operator role that can move between tenants for support is set in the deployment environment, not stored as data, so no administrator inside the product can grant it to themselves.

Microsoft Entra ID or Google, or a single-use link emailed to someone with no directory. Your directory decides who exists; revoking someone there ends their access from their next sign-in. The ID token is verified (signature against the tenant's published keys, plus issuer, audience, expiry, nonce and tid), never merely read.

Every answer carries which departments were asked, what each replied, the definitions it resolved, the record id behind every figure and whether each one verified. It is kept with the person who asked it and exports to a file. On our side, every question is recorded with what was asked, which departments answered, what it cost and how many of its figures verified, for the audit-trail period of your plan.