Trust starts at the boundary.

• Distinguish human identities from AI Crew actors.
• Deny requests when organization identity or permissions are unclear.
• Limit AI Crew to delegated scope rather than a person’s full permissions.
• Pause high-impact external actions at human approval points.
• Do not publish unverified certification badges or availability claims.

Human accounts sign in through the central identity provider and Auth service. Google sign-in binds external identity intent to request state and validates OAuth state, nonce and PKCE while explicitly requesting account selection.

After sign-in, the service uses a short-lived central session. Sign-out clears the session cookie and invalidates the session identifier. The UI does not create identity or permissions on its own.

Servers enforce organization data and permission boundaries. Services consume only allowed audiences and organization context. Visibility in the directory does not by itself grant data access.

SaaS, on-premises and isolated-network deployments have different operating conditions. Deployment scope, data location, updates and monitoring responsibility are finalized in the implementation agreement.

• Do not access, change or delete real user data.
• Do not conduct denial-of-service, bulk automation, phishing, social engineering or credential attacks.
• Do not include verification codes, passwords, OAuth tokens or customer source content in email.
• Allow time for verification and mitigation before disclosure.

This page does not authorize penetration testing. Agree on a written scope before any active testing.

When a security event is reported, we determine the affected accounts, organizations and services; restrict sessions or credentials; and preserve evidence and perform recovery as needed.

If a personal-data breach or material customer impact is confirmed, we provide notice of impact, response and user actions as required by law and contract. We do not claim recovery or minimize impact before verification.