Database-per-tenant isolation
Every organisation runs on its own isolated LibSQL/Turso database instance. Customer records, knowledge vectors, and conversation transcripts never co-mingle across organisations.
AES-256-GCM encryption at rest
Third-party tokens, OAuth credentials, API keys, and connection secrets are encrypted with AES-256-GCM before they reach storage. The encryption keys live in environment bindings, never in the database or code.
Scoped sub-agents
Each sub-agent only sees the knowledge, AI Forms, and connected apps you attach. There's no catch-all permission that quietly grants a helper access to everything your org has set up.
Permissioned embeds
The website widget authenticates its access and only runs on domains you allow. A pasted snippet is not a free-for-all API — visitors talk to the agent under the rules you set, not an admin surface.
Role-based team access
Owner, admin, and member roles decide who can configure agents, see transcripts, and manage connections. Visitors see only what the agent chooses to say.
Related docs