Access, data and what happens to it.

Read-only access

Our GP connector refuses any statement that is not a read, and there is no setting that turns that off. It connects through a login you create with read-only rights, on your live server or a restored copy. You own the login and can revoke it at any time; we ask you to when the assessment ends.

Credentials

Connection details are encrypted at rest with a key held outside the database, the key can be rotated, and each credential is stored against a single engagement.

Isolation

Each client is a separate tenant. Every request is bound to its tenant, and Postgres row-level security enforces the boundary in the database itself. Evidence files are stored content-addressed in private object storage, encrypted at rest and write-once.

Model usage

Agents work from a briefing compiled for each task: the relevant slice of your inventory and the evidence it cites, not a copy of your database. Model providers are used under agreements that exclude training on your data. Agent transcripts are retained as evidence for your engagement, and nothing from it informs work for other clients unless you opt in.

Data processors

Anthropic, for the models. Deepgram, for speech, only if you choose a voice interview. Plus the email and storage providers our deployment runs on, which we name in the data processing agreement.

Sign-in and roles

Engineers sign in through single sign-on (OpenID Connect, including Microsoft Entra ID) with roles per engagement. Your team uses personal portal links, and the portal shows who has access and lets you revoke it.

Business Central writes

During a migration, write access is granted per environment, expires after an hour by default, and moves from sandbox to UAT to production in order. Every production step needs its own approval after a go/no-go decision.

Audit

Evidence collected, fact changes, engineer decisions, approvals and releases are logged with who and when, in a log the database refuses to edit or delete. Your portal shows the activity on your engagement, and the full trail is available on request.

Deletion

On request at the end of an engagement, evidence, inventory and deliverables are erased and you receive a manifest of what was removed and what was kept. The audit log is kept. Erased evidence files are no longer reachable by the application, but the stored copies stay under a write-once retention lock until it expires, and backups age out on their normal schedule.

Need a security questionnaire completed or a data processing agreement? Mention it in your quote request and we will include it with the proposal.