Consent is built into how it works, not written in a policy.
Nobody has a profile they didn't sit down and create. Visibility is mutual by construction rather than by setting, and the list of things we deliberately never collect is published rather than implied.
Nobody has a profile they didn’t sit down and create.
An admin can open a workspace. Only the individual can create a profile in it — no HR upload, no SSO sync, no spreadsheet of names.
Dana
Engineering manager
Profile shared
Both ways, or not at all
Henrik
Senior engineer
Profile shared
Rae
Product designer
No profile at all
Rae declined. There is no partial record, no inferred placeholder and no greyed-out entry hinting at what might have been — and the assistant declines to speculate about her rather than improvising. Her employer isn’t billed for her either.
What we never collect.
Not a list of things we haven’t got round to. These are permanent product decisions, and we can’t use what we don’t hold.
No scraping
Nothing here is derived from the internet’s opinion of you — not LinkedIn, not your writing, not your talks.
No inbox or calendar
No email or calendar connector, so no meeting-load analysis and no “who you really work with” graph.
No meeting transcripts
We don’t join calls, record audio or ingest notes. What you said on Tuesday isn’t evidence we hold.
No activity monitoring
No keystrokes, screen time, commit counts or response latency. Working style is not a proxy for effort.
No profiles of non-consenters
We don’t infer someone’s style from their title or their teammates. No consent, no profile.
No enrichment, no resale
No data broker, no advertising identifier, no “anonymised” benchmark corpus built out of your team.
See how you work in six minutes
Free, no sign-up. Then bring your team in, free for five people.
Take it with you, delete it, or cut the connection.
Export, in two formats, whenever you like
Structured JSON and readable Markdown, with your scores, summary and pair guidance. If you cancel you keep the export — we're not holding your team's self-knowledge hostage to a renewal.
Delete, and it stops appearing immediately
Deleting removes it from every colleague's assistant at once. Live records go within the hour, backups within thirty days. Only the consent record survives, because we have to prove you asked.
Revoke an assistant connection from either end
Either the person who created the token or a workspace admin can revoke it, effective on the next tool call — so someone who leaves loses access before their laptop is collected.
Read the audit log yourself
Who looked up whom, when, and through which tool. Append-only, so nobody — including us — can quietly tidy it. This is the artefact to show a works council.
The questions the product refuses to answer.
Enforced in the server schema rather than requested in a prompt. There is no setting to loosen, no enterprise tier that unlocks them, and no support escalation that turns them on.
- No ranking or comparison of colleagues against each other
- No input into hiring, promotion, redundancy or performance decisions
- No inference about mental health, neurotype, or any protected characteristic
- No claims about anything that was not measured or explicitly recorded
What security reviews actually ask us.
No. Profiles are sent to your assistant as context at the moment you ask a question, exactly as any MCP tool returns data. Anthropic and OpenAI both offer commercial terms that exclude API and connector traffic from training, and those are the terms we operate under.
We do not train anything of our own on your team's data either — not a shared model, not an aggregate benchmark, not an anonymised corpus.
Send us your security questionnaire.
We'll answer it properly, including the rows where the honest answer is not yet.
See how it worksTell us what you’re working on.