The most sensitive list
your company keeps.
Who you are looking at, what you offered and what you decided is strategic intelligence of the highest order. In the wrong hands it is a roadmap of your intentions. It is protected on that assumption.
Defaults, not options.
Security that has to be switched on is security that somebody forgets. These are the standing properties of the platform, applied to every account from the first minute.
Reachable only by your organisation.
The strongest form of isolation is the kind that does not depend on application logic being correct. Access boundaries are enforced at the data layer, so a mistake in a feature cannot become a disclosure of your pipeline.
- Enforced below the application. Authorisation is evaluated at the data layer on every request.
- Scoped to the signed-in identity. A request can only ever reach records that identity is entitled to.
- Administrative access is separate. Platform administration lives on its own restricted surface and is never reachable from the product.
- Encrypted in transit and at rest. Standard throughout, with no configuration required from you.
Access that belongs to a person.
Shared credentials are how pipelines leak. Every action here traces back to an individual identity, which is what makes the audit trail worth anything.
Individual identities
Each person signs in as themselves, so every action in the record has a name attached to it.
Single sign-on
Join the identity estate you already run, so access follows your existing joiner and leaver process.
Scoped roles
Authority is granted deliberately. Nobody inherits approval rights or administrative reach by accident.
Session control
Session lifetime is an operator setting, so your own policy governs how long access persists.
A record that answers “who, when and why.”
Two years after a position is taken, the question is never whether something happened. It is who decided, on what basis, and under what authority. That has to be a record rather than a recollection.
Actor on everything
Every action carries the identity that performed it — a person, or the programme acting under a named mandate.
Reasoning preserved
The basis for a judgement stays attached to it, so decisions can be reviewed on their original merits.
Changes recorded
Changes to roles, limits and mandates are themselves auditable events, not silent configuration drift.
Directly readable
The people who need the trail can read it, without an export request or an engineering ticket.
Watched while it runs, not reviewed afterwards.
A quarterly access review tells you about a problem you had three months ago. Security events are surfaced as they happen, in a place somebody is actually looking.
Authentication events
Sign-in activity, failures and unusual patterns surfaced in real time with the context needed to judge them.
Privilege changes
Any change to who can approve or administer is a first-class event, visible immediately.
Access anomalies
Unexpected access patterns are raised for review rather than discovered during an audit.
Network controls
Operators can restrict access by network origin where their policy requires it.
Dependency health
The state of every external service the platform relies on, continuously checked and visible.
Triaged, not just logged
Events carry severity and resolution state, so monitoring produces decisions rather than noise.
Held on your behalf. Never repurposed.
Your pipeline is an asset you are lending us the responsibility of holding. The commitments around it are deliberately narrow.
- Your pipeline is isolated to your organisation
- Your record is exportable in full, on request
- Deletion requests are honoured
- Access is attributable to individuals
- Material changes are communicated
- Share your pipeline with another customer
- Sell or broker your strategic intelligence
- Use your positions as a reference without consent
- Hold your own record hostage
- Grant standing access to anyone outside your organisation
Degrades gracefully. Never silently.
Things fail. What matters is whether a failure quietly produces a worse answer or visibly produces a smaller one. The platform is built to always do the second.
No single point
An unavailable dependency causes reduced capability, not an outage of your programme.
Degradation is disclosed
When capability is reduced, you are told — rather than being handed a confident but weaker answer.
Independent mandates
One mandate running into trouble has no effect on the others.
Nothing lost on pause
Stopping, failing or resuming never discards a position, a conversation or a decision.
What security review asked for
Representative perspectives from security, risk and audit functions.
We did not want a certification badge on a web page. We wanted to know where authorisation is actually evaluated, and the answer being the data layer is what passed review.
Our audit function asked one question: can you show me who approved this and why, without asking anyone to remember. That was the whole evaluation.
The deal pipeline is more sensitive than most of our customer data. Treating it that way by default, rather than as a configuration we had to request, is why this cleared.
Perspectives are representative of the functions served and are not attributed to named individuals or clients.
Security questions
What security and compliance functions ask first.
Where is access control actually enforced?
At the data layer, evaluated on every request against the signed-in identity. That means a defect in an application feature cannot expose records that identity is not entitled to reach.
Can your staff see our pipeline?
There is no standing access to customer pipelines. Administrative capability is restricted, separated from the product surface, and every use of it is recorded.
Can we use our own identity provider?
Yes. Single sign-on lets access follow the identity estate and the joiner and leaver processes you already operate.
Can we restrict access by network?
Yes. Operators can apply network-origin restrictions where their own policy requires them.
What happens to our data if we leave?
You export it in full, and deletion requests are honoured. Your record of your own pipeline is never held as leverage.
Built to survive your security review.
Isolation at the data layer, complete attribution, live monitoring and clean exportability — as defaults, not as a premium tier.