Your work stays yours. Here is exactly how.
Before you connect a single tool, you should know where your agents run, what they can touch, how your keys are kept, and how you stay in control. Six plain answers, one step at a time.
In our secure cloud, in a workspace that is yours alone.
Your agents run in the TeyeMatics (said Tey-yeh-Matics) secure cloud on AWS, in the United States, in the us-east-1 region.
Each company gets its own walled-off workspace. The rows in our database are separated per company, and the database itself enforces that separation, so one company can never read another's.
The 30-day Observer runs there too, as a daily job. More on where it runs is in section 05.
- Your agents
- Your company's rows, and only yours
- The 30-day Observer, once a day
Only the tools you connect. Read-only, to start.
Your agents can reach only the tools you connect, and every connection starts read-only. Every email, post, message, text, image and video, and every payment or refund from a built-in tool, waits for a person in your company to approve it, always. Other actions, like updating a ticket, run on their own only if your owner allows it in your blueprint.
- 1Your toolsOnly the ones you connect. Each starts read-only.
- 2An agent prepares itThe email, the post or the message. It asks before it acts.
- 3 · It stops hereA person in your company approvesUntil someone says yes, nothing moves.
- 4Then it goes outOnly what was approved.
They ask, and they say what they cannot do
Agents ask before acting. When something is out of their reach, they say so plainly.
Payments stay read-only
A full Stripe secret key is refused, because it can move money. Stripe stays read-only.
Tested, encrypted, and never shown again.
A key is how an agent reaches one of your tools. Here is the whole path one takes, from the moment you paste it.
- 1You paste itOnce, on the connect page in your console.
- 2TestedAgainst the real vendor, before it is saved. A failed test saves nothing.
- 3Encrypted with your company's keyStored in AWS Secrets Manager with an encryption key that belongs to your company alone.
- 4Never shown againNot after saving, and never written to logs.
- 5Used by the workforce onlyOnly its own four system services can decrypt it.
Who can do what with your key
- The workforce's own four system servicesThe only ones that can decrypt it.
- Our own administratorsCan manage your key but cannot use it to read your secrets. Doing that would first mean changing the key's rules, and that change sets off the alarm in section 4.
- Each tool's permissionsWe ask for the narrowest permissions each tool needs. Tools that need broader access stay off unless you grant it.
Rather keep the key in your own AWS account?
- You create a role that lets us read only that one secret, locked with an ID unique to your company.
- We read it only at the moment of use, and keep nothing.
- Delete the role and our access ends at once.
If anyone else touches your keys, an alarm goes off.
An alarm alerts the TeyeMatics operations team if any of these happens.
- Anyone other than the workforce's own system services reads or uses your keys
- Anyone changes or deletes them
- Anyone tries to switch the alarm off
It reads only, and you approve what it reports.
The Observer reads only. It runs once a day for 30 days, on our strongest reasoning model, within a budget set before it starts. Today it runs in our secure cloud, reading through the read-only connections you grant.
Coming next: install it in your own cloud. Installed in your own cloud, it sends us counts by category, never a message or a file. If you choose, it can also send short work summaries with no personal or account details, and only after you approve them. There are three levels. Numbers: it sends only counts. Categories: it sends counts grouped by category. Work summaries: it sends short summaries, and only the ones you approve.
Your hand stays on the switch.
-
Pause anything
Any agent, any department, or everything, any time.
-
See every action
Every action is recorded in your Activity log.
-
Disconnect any tool
Whenever you choose. If your key lives in your own AWS account, deleting the role ends our access at once.
Asked across the table, answered straight.
No. Each company gets its own walled-off workspace. The rows in our database are separated per company, and the database itself enforces it, so one company can never read another's.
In the TeyeMatics secure cloud on AWS, in the United States, in the us-east-1 region. The 30-day Observer runs there too, reading only through read-only connections you grant. Installing it in your own cloud is coming next.
No. Every email, post, message, text, image and video, and every payment or refund from a built-in tool, waits for a person in your company to approve it, always. Other actions, like updating a ticket, run on their own only if your owner allows it in your blueprint.
Our own administrators can manage your key but cannot use it to read your secrets. Doing that would first mean changing the key's rules, and that change sets off the alarm in section 4.
Yes. You create a role that lets us read only that one secret, locked with an ID unique to your company. We read it only at the moment of use and keep nothing. Delete the role and our access ends at once.
A full Stripe secret key can move money, so it is refused. Stripe stays read-only. The Stripe setup guide shows how to make the read-only key we ask for.
Nothing is saved. Every key is tested against the real vendor first, and only a key that passes is stored.
Pause any agent, any department or everything, any time, from your console. Every action is recorded in your Activity log, and you can disconnect any tool.