From permission management to data protection and audit logs, Botify provides the foundations organizations need to operate within security, compliance and governance requirements, adaptable to each organization’s needs.
Control who can access information or execute actions, by role and responsibility.
Complete documentation of all operations and actions for easy review and compliance.
Encryption of data in transit and at rest, following security best practices.
Each organization has its own independent data and environment for the highest privacy.
Integration with identity and user-management systems inside the organization.
Protecting sensitive information while complying with organizational policies and requirements.
Security & governance center
All systems protected
Recent activity
Each organisation has its own space, and every query is scoped by its identifier at the service layer. That is tested rather than assumed: a test genuinely attempts a cross-boundary read and expects refusal, because one query missing the filter is enough to leak one customer’s data to another.
Data is encrypted in transit and at rest. Keys for connected systems and custom server headers are encrypted in the database and decrypted only at the point of use, and never returned in any API response, not even to the account owner. A "configured / not configured" flag is returned instead of the value.
Not one permission is copied out of your system. With Odoo connected, operations execute as the employee through `with_user`, so Odoo re-decides what they may do at that moment. A copied permission list goes stale the instant an admin edits a group; this design cannot go stale.
Reads are guarded by your systems. Writes are irreversible, so each is shown in its final form and waits for explicit in-chat approval, then is recorded in an audit trail attributed to the real user, not to "the agent".
Any text the model reads may carry instructions: an uploaded document, an inbound email, a customer message. The defence is not asking the model to ignore them (it is unreliable at that) but that it never had the authority. Tools are bound to what the user may do, so what the model was persuaded of does not matter.
Personal-data export and erasure are available from the console, and retention policies are configurable per workspace. Erasure covers conversations and the external identities attached to them, not merely the visible records.
Yes, and deployment options vary with your regulatory requirements. Constraints that require data to remain on your own infrastructure are handled at design time, not after launch.
Only workspace members holding the conversations-read permission, and permissions are customisable by role. Access to the audit trail is itself a separate permission that is not granted automatically.
A short session with your documents and systems, and you will know within the hour whether this fits.
