The questions to ask before you put an AI worker on your channels.

What you upload answers your own questions and nothing else. Under the API terms on which we access the AI providers, data submitted through them is not used to train their models, and that sits in our data processing addendum rather than on a policy page you have to take on trust.

Workers answer from your own documents first and show which one was used. Where they cannot find it, they say so and hand over instead of inventing an answer.

A second check reads the draft against your company profile, your knowledge base and whatever the worker looked up. A reply that states a price, a policy, a delivery time or a completed action that none of them support is held back, the customer is told your team will come back, and the original is kept in the audit log. This is on by default for every customer-facing worker.

You choose which actions cannot happen without a person pressing send: quotes, campaigns, public posts, anything that touches money. Every sign-off is logged with who decided and when.

Logins, permission changes, agent actions, approvals and data exports are all recorded. When someone asks what happened on a given day, there is an answer.

Access, correction and erasure requests come in through a public form, get identity-verified, and are tracked to completion. Consent is stored in an append-only log, and every campaign carries a working unsubscribe and preference page.

Retention windows for conversations and audit records are set by you, and old data is cleared automatically once they pass.

Per-user permissions, separate roles for admins and staff, optional two-factor authentication on every account, and teams and divisions once the rollout gets larger than one office.

Each worker carries a monthly ceiling and the workspace has a harder one above it. A misconfigured worker or a runaway loop stops at the cap rather than turning into an invoice.

API keys and channel tokens are stored encrypted, never displayed back in full, and never exposed to the tenants who use the features they power.

Plans can run up to three frontier models in a set order. If one provider degrades, the next takes the request, and higher tiers can cross-check the answer across all of them.

Every worker begins in training, answering only to you. You promote it to supervised, and to autonomous later if you ever want to. The state is yours to set and to reverse.