Your data, your tools,and the boundary around them.

Fail-closed tenant isolation

Every query is scoped to your organisation at the data layer. A request that cannot prove its tenant is rejected rather than broadened.

Per-tenant vector namespaces

Embeddings are partitioned by tenant, so retrieval cannot cross an organisation boundary.

Owner, admin and member roles

Applied to agents, documents and settings, so a member cannot change what an admin set.

Tag-based document access

Documents carry tags; a user's retrieval is scoped to the tags granted to their own account.

Supabase-backed auth with JWT sessions

Short-lived access tokens with automatic refresh; API keys are scoped and revocable.

Encryption in transit and for stored credentials

Public traffic to auramind is TLS-terminated. Third-party credentials — API keys and integration secrets — are encrypted at rest.

No training on your data

Your documents, agents and conversations are never used to train a model. Every provider auramind routes to operates under zero data retention, so prompts are not kept on their side either.

Deletion removes derived data

Deleting a document removes its chunks and embeddings, not just the file.

Scenario evaluations

Repeatable scenarios classify behaviour as pass, fail or flaky across repeat runs.

Loop and stall guards

An agent that calls the same tool with the same arguments and gets the same answer back is stopped and told to change course rather than allowed to spend the run repeating itself. A run that stops making progress ends instead of grinding to its ceiling.

Sandboxed code execution

Code the model writes runs in an isolated container that is a separate trust domain from the application, with no network of its own. Anything it reaches goes through a proxy that decides per connection and logs the outcome.

Append-only run history

No endpoint deletes or edits a run, its trace or its recorded writes — there is nothing to misuse. History deliberately outlives its surroundings: deleting a conversation keeps its runs, and an agent with runs behind it is retired, never erased, so every run stays traceable to the configuration that produced it.

Run traces

Every model call and tool call in a run is recorded with measured latency and token counts. Model calls are logged without their text — the trace shows that the model was consulted, with which model and at what cost, never what was said.

A registry of outward writes

When a run's connector call creates, sends or updates something in an outside system and succeeds, a record is kept against that run — named in our own vocabulary, not the connector's.

Run content stays with its initiator

Tool summaries and outputs in a trace are visible to the person who started the run. Admin roles see that runs happened, how long they took and what they cost — not their content. The exception is deliberate: an org-shared agent running on a schedule or webhook answers to org admins, because nobody sat behind it.

Analytics without content

Usage aggregates — runs, failures, latency, tokens, per-tool counts — are scoped to your role at the query level and carry no message content and no user identifier in the response schema.