Security
You will not read here that security is our priority. You will read which mechanism protects which thing, with which number, and at the end a list of what is not built yet.
Isolation between companies
The question every head of IT asks is whether the neighbour can read their documents. The short answer is no. The long one is that you would have to break four separate things to manage it.
Every row belonging to a company carries its identifier, and the active company is taken from the session’s verified header, never from the request body. Both legs of the search, the semantic one and the exact-term one, carry the company condition inside the SQL. It is not a filter applied to the result.
PostgreSQL enforces row level security in FORCE mode over the 33 tables that carry a company identifier. The identifier is set inside the transaction, and that scope is transactional, so a connection reused from the pool cannot drag the value into the next request. A test verifies that every new table with a company identifier has the policy switched on, and it breaks the integration run if anybody forgets.
One directory per company, created in mode 0700 and owned by the service user. Even if the application code got it wrong, the operating system will not let one company’s content be read from another. The directories are reconciled idempotently on every install.
One namespace per company identifier, keyed on the UUID rather than the short name, so renaming a company never orphans its graph. The client never sends graph queries: the service builds them and validates any path against that company’s own documents before touching anything.
A dedicated suite tries to cross those boundaries on every change, with concurrent requests interleaved between companies. It is the test we most want to keep failing the day somebody breaks something.
Authentication and exposed surface
None of these lines is novel. Every one of them is the kind you notice missing once something has already happened.
The agent
An agent that writes files is useful precisely because of what it can do. What your IT team needs to be able to point at is where it stops.
Every agent chat works inside the file subtree of its own project. Parent projects and connected projects are not mounted: the agent knows them through the summary we inject, carrying the description, the memory, the open tasks and a file listing. We put it that way, rather than as a per-file permission, because that is what the system enforces today.
A session with no path assigned fell through to the company root directory, and from there one department’s chat could read another’s files. Today a path that cannot be resolved returns a directory isolated per company, never the vault root. We tell you because it is exactly the kind of bug a vendor would rather not mention.
Every time the agent dispatches a tool, a row is written with the hash of the arguments, whether it finished cleanly, how long it took, and the previous row’s hash chained to this one’s. Editing or deleting a row breaks the chain and it shows. The raw arguments are never stored, only their hash. On top of that, every AI call leaves a line in a monthly log on disk recording the size of the text covered, never the content.
The cage the code runs in
When the agent runs Python, it runs in a rootless container that is born for that execution and dies when it ends.
The permission is checked before the container is created, so a request from somebody without the role never gets anything started.
Operations
The part nobody looks at in the demo and everybody looks at on the first bad day.
If you would rather none of this ran on our infrastructure, the Enterprise tier installs the whole platform on your server, with the same backups and the same proxy. See plans
At 03:30 both databases are dumped with pg_dump along with the global roles. They are kept for fourteen days.
Files that did not change are linked to the previous day’s snapshot, so each day on disk costs only what moved.
Every service binds to 127.0.0.1. The only reachable thing is the reverse proxy, and its configuration travels inside the repository.
Database, embedding server, cache, graph and backup timers all come up with a single idempotent command. Running it twice breaks nothing.
Usage logs, permissions, sessions, messages, notifications, secrets and threads go with it. Tests verify that nothing is left orphaned.
A health probe restarts only the service that stopped answering, which is the case a process supervisor misses because the parent process is still alive.
No decoration
Your IT team is going to ask for this list, and if we do not publish it they will find it anyway. It is cheaper for both of us that it is here.
No SOC 2, no ISO 27001, and no security audit performed by a third party. The intrusion testing we run is our own and it does not substitute for an external auditor. If your procurement process requires a report signed by somebody outside, we do not have one today.
Rootless, no network, read-only root and no capabilities, which is a serious boundary. But it shares the host kernel, and anyone evaluating this knows the difference against a lightweight virtual machine. There is a written design for getting there. It is not built, and until it is it does not appear on this page as though it were.
Python execution runs with no network, and that is literal. But the box the agent itself runs in does have egress and we do not yet filter where to. They are two different things and blurring them would be selling smoke.
There is TLS in transit, secrets encrypted with pgcrypto in the database, and whatever encryption the server disk provides. Saying everything is encrypted at rest would be false: the vault is Markdown files readable by anyone with access to the server’s file system, and that access is governed by mode 0700 and by whoever administers the machine.
The permission-by-permission check exists in the tool surface and is tested, including the case of a reader denied a write. It is not on the active path by default, so today’s real boundary is the department folder mounted into the container.
It depends on where the installation is hosted and on the model provider. If your company needs data not to leave a jurisdiction, the only honest route is self-hosting, and we will gladly confirm in writing what the managed installation meets before you sign.
The precheck is written and tested, but no agent route calls it yet. You see exactly what you spent and we tell you, and that is what we can promise today.
If anything on this list is a hard requirement at your company, say so in the first conversation. We would rather lose the sale than have you find out during an audit. ventas@ofivia.com
The usual ones
The five that come up in every review, with the short answer.
If your head of IT has an objection, better to hear it before the migration than after. We will sit down with them.