Explicit access. Inspectable controls.
Understand workspace boundaries, account protection and the controls around your research. Review deployment terms before choosing sensitive inputs.
Workspace boundaries
Access is organized around workspaces, memberships and explicit roles.
Workspace roles
Separate Admin, Builder, Reviewer and Viewer responsibilities.
Audit log
A hash-chained log of who did what, kept at least 400 days per workspace.
Share controls
Review share links before making a report accessible.
Authentication
Choose authentication methods suited to the people using your workspace.
Email and password
A familiar account sign-in flow.
Multi-factor methods
Passkeys, authenticator apps (TOTP), SMS codes and backup codes. Passwords are hashed with Argon2.
SSO and SCIM
Google Workspace or OpenID Connect sign-in and SCIM provisioning, on plans that include them.
Session controls
Verify your email, review active sessions and sign out of the ones you don’t recognise.
Research controls
Use the plan, effort and report evidence to keep a run inspectable.
Plan review
Inspect the intended research before approving when required.
Research budgets
Each effort has a research budget enforced on the server, and every job shows what it cost.
Source inspection
Review the source excerpt behind a finding.
Data and files
Before adding private context, confirm the controls and terms for your deployment.
File context
Review which files you attach to a run.
Report access
Keep report and share permissions appropriate to the audience.
Retention
Keep files from 30 days to 7 years; secrets and provider keys are stored encrypted.
Human approval
Actions that change a system need a clear approval policy.
Proposed actions
Inspect what an agent is suggesting.
Reviewer role
Keep the person making a decision explicit.
Corrections
Preserve the evidence behind a revised finding.
Incident response
Production response procedures and service commitments must be confirmed for your deployment.
Report a concern
Email rahul@iamrraj.com with the details.
Capture context
Include the run ID, time and relevant evidence.
Avoid secrets
Do not put private credentials into a report.
Match the review to the impact.
Critical · Potential data exposure
Stop the affected activity, preserve evidence, and email rahul@iamrraj.com straight away.