Security & trust
What is actually built, in plain terms, so your security review can check it against the product instead of a claim.
Only approved content is ever served
Draft and in-review revisions are never returned by the API, the MCP server, or the app itself. That rule is enforced at one code chokepoint that every read passes through, not by a policy setting or a prompt.
12-family audit event catalog
Authentication, authorization, membership, connectors, imports, document changes, classification and policy changes, billing and API access, and organization export/deletion are each a tracked event family with a named approver where one applies. Export the trail as CSV for a security review or an internal audit.
Two-level classification, enforced per token
Every document is classified internal or external. Every API token is scoped to the classifications it may read. Both checks run at the same single read chokepoint as the approval-status check, so a token cannot read past what it was scoped to see.
Isolated per organization
Every organization is its own tenant. A token minted for one organization cannot read another organization's documents, workspace, or usage.
OAuth 2.0 authorization server for MCP
The hosted MCP server is backed by a real OAuth 2.0 authorization server: PKCE on every authorization flow and dynamic client registration, so an MCP client can connect without a manually issued secret.
Your knowledge stays portable
Every concept doc is plain markdown with a YAML frontmatter header underneath, built on the open Open Knowledge Format. Nothing about leaving requires reformatting your content first.
Compliance status
The honest state of the items a security review usually asks about first.
- SOC 2 Type II
- Not started. A Type II engagement has not yet begun and is planned; we will publish status here once it does.
- Single sign-on (SSO)
- Not shipped. OIDC sign-on is on the Enterprise roadmap; SAML and SCIM are planned after. Contact us to discuss timing.
- Data Processing Addendum (DPA)
- Available on request for Enterprise customers.
Running a security review?
Send us the control questions your review needs answered, and we will reply directly rather than pointing you at a brochure.
