Methodology can travel. Client facts shouldn’t.

The separation between reusable firm capability and client-local context is the thing a client is really asking about when they ask whether you use AI. This page states exactly where the line sits and what enforces it.

One engagement, one workspace

Each client engagement lives in its own workspace. Its documents, uploaded knowledge, sessions, session history, memory and outputs belong to that workspace and are addressed through it.

The boundary is enforced in the database

Access control is row-level security on the tables themselves — every table, every query — rather than a filter the application layer is trusted to remember. A query that should return nothing returns nothing, including for a query the application never intended to make.

What may cross between engagements

Specialist and team definitions, working standards, and knowledge you have explicitly scoped as firm-level. These describe how your firm works, not what any client told you.

What does not cross

Client documents, interview material, engagement-scoped knowledge, session history, memories scoped to the engagement, and the outputs produced in it. Moving any of that elsewhere is something you would have to do deliberately and visibly.

What a specialist can see when it works

A specialist working in an engagement draws on that engagement’s context plus the firm capability you made available. It has no route to another engagement’s material — the same row-level rules apply to it as to a person.

Memory has a scope, and personal memory has a gate

Durable memory carries an explicit scope rather than being a single pool, and memories at personal scope are saved only with your explicit approval. What a specialist remembers is therefore something you can describe to a client.

Limits

What we are not claiming here

Stated here rather than discovered later. If a claim is not on this site, assume we are not making it.

This page describes isolation and access control. It does not make claims about encryption specifics, hosting region, retention or deletion guarantees, or formal certifications.
Anything you deliberately move to firm scope leaves the engagement boundary. The boundary protects against accidental crossing, not against a decision to copy something out.
For the verified detail on storage, sub-processors and your data rights, the security page is the authority — not this page.

Review security and data handling →

Also in this section

The rest of the detail

Methodology & knowledge
How reusable firm capability is maintained separately from client facts — and what reuse does and does not do.
Quality & review
What the critic and validator actually do, and where accountability stays.

See it working.

Free recorded demo · No live AI calls

Try the interactive demo Go to Launchpad Live Walk through your use case with us