Nothing happens
without a record.
Three guarantees hold across every station of the loop. They are not settings, and there is no plan on which they are relaxed.
A human signs every send
Approval binds to one exact version of one message. Edit a word and the approval voids. There is no autopilot mode and no overnight queue that bypasses this.
Consent before storage
A website visitor agrees before anything about them is kept. Until they do, the session stays anonymous and writes nothing to your account memory.
Isolated per customer
Row-level security scopes every query to your tenant. Seat and contact limits are database constraints, not warning banners you can click past.
Every action, attributable.
Receipts are written by the system, not by the user, and cannot be edited after the fact.
SAMPLE RECEIPT · NOT A LIVE APP CAPTURE
Approve v4, and only v4 can be sent.
The signature is stored against a hash of the exact message. Change one character and the hash no longer matches, so the approval no longer applies.
- Full export of your account memory, receipts and audit trail on request.
- Deletion on request, including derived claims and thread history.
- Proof board links are capability-scoped and revocable at any moment.
- Enrichment happens through approved partners, with provenance recorded.
No silent autopilot
There is no switch that lets the system send on your behalf unattended.
No unbound approval
A signature applies to one version only. It cannot be carried to edited text.
No scraping
Channels are reached through approved integrations, never by circumventing them.
No storage without consent
An anonymous visitor stays anonymous until they choose otherwise.