Control lives in the server, not in the interface.

Tenancy and access

1. Isolation by organization

   Every token carries the organization it belongs to. Handlers derive the organization from the token and never from a field the client can set, so one customer cannot address another's data.

2. Roles map to a permission catalogue

   A role in an organization mints exactly the scopes its permissions allow. Platform operators are a separate, narrow role that lives outside every organization.

3. The interface is not the control

   The console hides what you may not do, and every backend validates the token's scope again before it acts. The check that matters is the one on the server.

4. Service to service is explicit

   Backends authenticate to each other with signed tokens validated against a key set, authorized by a declared grant matrix rather than by network position.

What is recorded

1. Append only trails

   Inference, knowledge, web search, code execution, agent runs, data operations and privileged administration each keep their own trail. Records are added, never edited.

2. Hash chained agent runs

   Each step in a run carries the hash of the one before it, so a record removed or altered after the fact breaks the chain and shows up as a break.

3. Evidence pack per run

   A single run can be exported with its steps, inputs, outputs, approvals and correlation, which is the artefact an auditor actually asks for.

4. Cost is part of the record

   Tokens and price are recorded with the request, so a bill can be reconciled against the trail rather than trusted.

Data handling

1. In the European Union

   Databases, object storage and trails are hosted in the EU on European infrastructure.

2. No training on your data

   Prompts, documents and produced files serve your requests and nothing else.

3. Request bodies are not stored by default

   The trail keeps metadata, token counts and cost. Storing full bodies is an organization's decision, with its own retention.

4. Two retention clocks and a hold

   The payload is scrubbed on the first clock, the record is deleted on the second, and a legal hold suspends both. Files produced by the platform have a clock of their own.

Execution and secrets

1. Customer code has no network

   Code runs in an isolated sandbox whose network is cut inside the runner itself rather than by a rule somewhere upstream of it.

2. Tools run through a broker

   An agent never holds a credential. It receives a capability minted for one call, and the broker performs the call and records it.

3. Secrets come from the environment

   Nothing sensitive is written to a config file or a log line. Configuration secrets are encrypted at rest, and API keys are stored as hashes.

4. Approval before consequence

   An effect that changes something in the world can require a second person before it runs, and the approval is part of the record.

Reporting a vulnerability

If you believe you have found a security issue, tell us privately first and give us a reasonable window to fix it. We will confirm receipt and keep you informed.

[email protected]

https://neurifly.eu