Every table that holds a customer's rows carries a row-level security policy, and the application connects as a role that cannot bypass it. A query with no tenant context returns no rows, whatever the code above it asked for. The sections below run in the order a questionnaire usually asks.
Same table, same query, same role. The policy matches nothing, and the application is told so.
rows returned to a query with no tenant context
checks between the public edge and a row
access classes, from Subscriber Admin to Recipient
permissions those classes are built from
days an invitation link stays valid
Five checks
In the order a request meets them. Each check is made on its own.
Check 1
The edge
Traffic reaches the application through an outbound tunnel with an access policy in front of it. No application port on the host answers the internet, and the host keeps its own firewall behind the cloud one. The administrative surface is a separate deployment on its own hostname, behind its own access gate.
Check 2
Signing in
A password and a one-time code, or Microsoft Entra ID where the deployment enables it. The tenant is fixed into the session at sign-in and never re-read mid-session, so changing a record cannot move a live session into another tenancy.
Check 3
Inside a request
API routes resolve the tenant before they read anything. The backstop sits below them: a route that forgets to scope a query gets no rows back.
Check 4
The database
Row-level security on every tenant table, with the tenant set per transaction. The application connects as a role that cannot bypass those policies.
Check 5
Downstream services
Search and source-code analysis receive a tenant identifier they cannot widen, and the token that reaches them names the project as well as the tenant.
Inside a project
| Person | Seat | Documents | Request list | Report | Insights | Analyst files | Team |
|---|---|---|---|---|---|---|---|
Subscriber Admin H. Brennan · Your firm Edits Documents, Request list, Report, Insights, Analyst files, Team | Counted | Edit | Edit | Edit | Edit | Edit | Edit |
Project Lead J. Lindqvist · Your firm Edits Documents, Request list, Report, Insights, Analyst files, Team | Counted | Edit | Edit | Edit | Edit | Edit | Edit |
Team Member P. Adeyemi · Your firm Edits Documents, Request list, Report, Analyst files · Reads Insights | Counted | Edit | Edit | Edit | Read | Edit | — |
Contributor M. Okafor · Arden Systems Edits Documents, Request list · Reads Insights | Not counted | Edit | Edit | — | Read | — | — |
Reviewer S. Marsh · Invited expert Reads Documents, Request list, Report, Insights, Analyst files | Not counted | Read | Read | Read | Read | Read | — |
Viewer R. Costa · Your firm Reads Documents, Request list, Insights | Not counted | Read | Read | — | Read | — | — |
Recipient A. Whitfield · Lender's adviser Reads Report | Not counted | — | — | Read | — | — | — |
A seat is held by anyone who can author or approve a finding, create a project or administer the workspace. Contributors, reviewers and recipients never hold one, and an invitation holds a seat from the moment it is sent.
The 7 classes in the ledger decide what each person in a project can open. Remove a member and their access ends at once; a finding they signed off stays attributed to them. There is no repository role. The source-code extract is produced by the target's engineers inside their own network and uploaded by your team, so the person who produces it needs no account here.
The target's people. They upload documents and work the request list, hold no seat, and can read insights. The Report tab and the analyst files are closed to them, and they cannot edit a finding.
Team member is the working role: reads the evidence, drafts and edits the report, holds a seat. Reviewer is read-only across the project, holds no seat, and is also the standing an outside reader has when a review round asks them to mark up an issued release.
Reaches one issued report through a share link, under the agreement you attached to it. No other project, no team, no settings, and nothing behind the report.
Outside readers
Sharing an issued report outside the project happens under agreements you set, and the record of who accepted what is kept as evidence.
Confidentiality and non-reliance agreements are accepted before any content loads, and the check runs at the one point every share-scoped request passes through, so no route can serve a page around it. On the upper plans the wording is your own, and a negotiated reliance letter is recorded as an executed instrument: the reader sees its date and liability cap on every visit, and a lapsed letter closes the gate.
Each acceptance or decline is stored with the person, the agreement version, a hash of the exact text, the time, the network address and the browser. The reader receives a copy of what they accepted by email, and the ledger for a project downloads as a CSV for the deal file.
A ribbon the reader cannot dismiss states their posture, and a repeated watermark carries their identity. Printing, Save as PDF included, produces a single notice sheet instead of the report. A determined reader can still take a screenshot. This closes the easy copy, not the impossible one.
An invitation link is single-use, lives 14 days and is stored only as a hash, so it cannot be replayed once claimed. Every recipient is named on the version they can open, with the state of the invitation, expired included. When someone can still open a superseded issue a banner says so, and one confirmation closes it. A withdrawn version stays in the history with its reason.
Documents and models
Depending on how you are deployed, analysis runs on infrastructure we operate or routes to hosted model providers. We state which providers a deployment uses, in writing, on request — the terms say the same — and your documents are never used to train models.
Usage is measured in our own database. No analytics or advertising script loads on a page showing your material, and what is recorded is identifiers and counts: that a document was indexed and how many passages it produced, never its name, the project's name or a search query. The public site is separate, asks first where consent is required and offers a one-click opt-out everywhere.
TLS at every public edge. Inside, services talk over a private network with no publicly routable ports, and stored files and derived data are encrypted at rest.
An agent you connect uses a model you chose and operate. Its key is scoped to one project with read, write or research permission, stored only as a hash, expires after 90 days unless you set a longer life (a year at most), and can be revoked at any time. Every call is attributed to the person who minted it.
Removing a document withdraws it from search before the row is dropped, and a deleted file turning up in search is a case we test for. Ask for a documented deletion and support confirms what was removed and when.
Support can see a workspace's structure, its runs and its errors. Nobody opens a project document to answer a ticket unless you name one, and we say so when we do. Tickets are answered within one business day.
The terms make your documents, findings and reports Confidential Information: used only to provide the service, disclosed only to providers bound in writing, never training data, deleted on termination. A countersignable Confidentiality Addendum is available from your Legal settings for a counterparty who needs us bound on paper.
Outbound connections
A questionnaire will ask what connects outward from a project, and when. This is the whole list.
Private source code
Never
The target’s engineers run the extractor inside their own network and hand your team the bundle: commit history, authorship, file and language distribution, dependency manifests. We hold no credentials to any source host.
A public repository
When you paste its URL
One clone of that repository, made without credentials. A supplied credential is refused.
The open web
Only when an analyst registers a page
The analysis does not search the web. A page enters a project when an analyst adds it to the register, and it is fetched through the indexing service’s egress guard, which refuses private addresses. The public posture of a registered domain (DNS, TLS, HTTP headers) is read the same way.
Public package registries
During source-code analysis
Component names and versions from the components inventory, checked against public advisory and registry data. No document text.
A hosted model provider
Where a deployment routes a workload there
Document-derived text for that workload. We state which providers are in use, in writing, on request, and it is never used for training.
When a project ends
Procurement always asks this before it asks anything else. Here is what happens to the material.
Projects over the new limit become read-only. Issued report versions are retained. External shares that are live run to their expiry unless you revoke them.
A document leaves the search index before its row is dropped. Deleting a project needs the permission to do so and removes its material. A documented deletion, confirming what was removed and when, is yours for the asking.
Ask support, and we confirm the deletion in writing. There is no bulk export of a workspace. A report lives at its link, where a correction reaches every reader, and it stays readable there.
Not claimed
Three things a reviewer will ask about, and where we stand on each.
None completed, and we will not imply one. Ask and we will tell you where we are in the cycle, with dates.
No test report is published here. If you need to see one before you upload, say so and we will discuss what we can show you.
That depends on how you are deployed, and so does which models process it. Ask, and we put both in writing.