What it can reach, what it will never do, and what we do not claim

Every action a specialist attempts is decided by a single function, against the class of work it belongs to. There is no second route to the outside world. Three things hold whatever you configure: account and security changes never run without a person, spending never passes a ceiling you set yourself, and a specialist can only ever be more restricted than its workspace, never less.

Permissions are checked in code before an action runs. A specialist that was not granted the ability to send email cannot send email, whatever any prompt says. This matters most for the case that actually happens: an email or a web page containing text written to be read by an AI, telling it to do something. The instruction can be read. It cannot be obeyed past the fence.

Inbound mail is the most likely place someone tries this, because an attacker can put whatever they like in it and be confident something will read it. The address a workspace receives mail on contains a random token rather than the business name, so it is not guessable, and nothing that arrives decides what a specialist is allowed to do.

Each connection asks for the smallest set of permissions that makes it useful, and the ability to change or send something is always separate from the ability to read. A workspace that has never unlocked outreach does not hold a permission to send mail — if we are breached, what is exposed is what was in use, not everything that was ever possible. Before you connect anything, you are shown what it will be able to do and what it will never do, in plain words.

A refresh token for a mailbox is, in practice, the mailbox — indefinitely and quietly, until someone notices and revokes it. So they are encrypted at rest with a key held outside the database, and the table holding them has no read policy at all. Database separation stops a query reaching the wrong rows; it does nothing about a stolen backup. Both have to be taken for either to be worth anything.

If you sell through Operenda, payments settle into a Stripe account you own, in your name, and Stripe pays you out directly. We are not in the flow of funds at any point and we take no percentage. Card details go from your customer’s browser to Stripe and never touch our servers, our logs or our database — nobody here ever sees a full card number.

Sending is refused unless your domain’s SPF and DKIM records are in place and verified, and there is no override — a caller that wanted to skip the check would have to change the file that performs it. Unauthenticated mail sent on your domain would damage your reputation for months and you would have no way of knowing we had done it. Setting up and verifying a domain works today; nothing sends through it yet.

What the business knows is built from executed actions and decisions you made — never from a specialist’s plans or prose. A store full of things an agent merely intended is worse than no store at all, because every later run then reasons from fiction.

Every action, what the gate decided about it, and what you decided afterwards. Refused attempts are kept as carefully as successful ones — a record that only contains what worked cannot answer the question you will actually ask.

Every table holding a business’s data is scoped to its workspace and enforced at the database, not only in application code. Published customer sites are served from a different domain from the app, so a problem on a page cannot reach the app’s session cookie.

A link emailed to you, a Google or Microsoft account, or an optional password you add from inside your own account. On top of any of those you can switch on two-step verification with an authenticator app, and an owner can require it of everybody in the business. Somebody who has your email and nothing else can then get as far as the code box and no further — not into a screen, not into the API, and not into switching the second factor off.

A reset link sent to your inbox is exactly the single factor two-step exists to move past — it would let anybody holding your email walk in through the back. So we never send one. If you forget your password you sign in with a link as you always could, clear your second factor like any other day, and set a new password from your security screen. Recovery codes work the same way: shown once when you switch two-step on, never emailed, and never shown again.

Every browser and device holding a sign-in for your account is listed with what it is and when it was last used, and you can end any of them — the ordinary case being a laptop left somewhere. Disconnecting an account, releasing your phone number, exporting everything and removing a colleague each ask for your code again, so that a session somebody else is holding cannot quietly take the business apart.