Keeping organisations apart
Three independent controls, none of which relies on the other two being correct. Removing any one of them would still leave the other two enforcing the boundary.
The connection carries your organisation
There is one supported way for application code to reach the database, and it stamps the caller's organisation and identity onto the connection before any query runs.
Every query is filtered
The filter is applied centrally to every record type that belongs to a customer, so a new query cannot forget it — there is no per-query opt-in to leave out.
A crossing write is refused
Writes pass an interceptor that refuses to move a record from one organisation to another, and refuses every write at all during a read-only support session.
What a deletion really does
Nothing in this platform is hard-deleted. Deleting marks the record hidden and records who did it and when; the recycle bin puts it back. Permanent removal exists, is restricted to an operator, and is a separate deliberate act — never a side effect of pressing delete.
What an AI assistant can reach
Only what your organisation has switched on, and only through the same code a person uses. Every tool call passes the licence check and the permission matrix before it does anything, including a read.
- Default
- No permissions at all until your organisation sets them
- Model training
- We train no models on your data
- Changing the permissions
- Only a person, only from the web — no tool can edit the matrix
Accessibility
Every screen is held to WCAG 2.2 Level AA, in light mode and in dark mode. Under the BFSG, EN 301 549 makes that the legal bar for a product sold to the public in Germany, so a screen that misses it is a defect here and not a nice-to-have.
Contrast measured, not estimated
Against the colour an element actually sits on, in both themes — which is where a palette that looks fine usually fails.
Operable from the keyboard alone
Every control reachable, every focus ring visible, and nothing reachable that cannot be seen.
Never colour or shape alone
A state that matters is always carried by words as well, so it survives a screen reader and a colour-vision difference alike.
Every control has a readable name
An icon-only button carries a name that says what pressing it will do, and names the record it will do it to.
A page load fetches nothing from anyone else
No external fonts, no analytics, no content delivery network, no embedded maps or videos. This is not a preference we hold loosely: adding one would make this sentence untrue, and the release process checks the claim.