You share the platform with other businesses. You don't share the data. Every database query is scoped to your workspace before it runs, so another customer's workspace doesn't read yours — and yours doesn't read theirs.
The mechanism: the workspace filter is the query default — it sits on 769 workspace-scoped queries across the app.
Inside a single workspace, each person's Compass conversations, priorities, and interventions belong to them. Even the workspace owner doesn't see another member's private threads — they're scoped to the user, not just to the workspace.
The mechanism: Compass chats and inbox rows are scoped by user as well as by workspace, so a member's private work isn't visible to anyone else.
Your Brain is the workspace's shared memory, and access to it runs through one control point. You set the access posture on your knowledge — open, restricted, or locked — and a locked collection denies everyone except the owner and admins. You decide how open each part is.
The mechanism: a single access-control chokepoint resolves open, restricted, and locked postures, with per-member overrides and per-type role gates.
Actions across the platform are written to an audit log — who did what, and when. High-stakes operations record their trail, so the important moves can be read back later instead of vanishing.
The mechanism: 77 audit-log write points across the app, plus one shared logging helper the routes call.
Marketing and outreach email checks the suppression list — the do-not-contact and unsubscribe record — before it sends. Transactional messages you trigger yourself — a login code, a receipt, a booking confirmation — are exempt by design.
The mechanism: one consent gate reads the suppression record in front of the send path, before an email leaves.
When you connect your own provider keys — the credentials LoadBear uses to act for you — they're encrypted with AES-GCM before they land in the database. It's the secret columns that are encrypted, not the entire database, and that's the honest scope.
The mechanism: bring-your-own-key credentials are sealed with AES-GCM, a fresh initialization vector per value, at the point they're stored.
When the platform fetches a URL for you — a site to render, a link you handed it — the request goes through one guarded door. It validates the address, blocks private and internal network ranges, and re-checks the destination on each redirect — defense in depth against requests that try to reach inside.
The mechanism: a single guard validates the URL, refuses private, loopback, link-local, and metadata addresses, refuses URLs carrying embedded credentials, and re-validates each redirect hop.
You can export your workspace's data. The export leaves out the auth and session tables by design — logins, one-time codes, reset tokens — and redacts secret columns like keys and passwords. You get your business data; the security plumbing stays out of the file.
The mechanism: the exporter skips session, auth, reset, rate-limit, and migration tables, and redacts token, secret, password, api-key, and credential columns.
Pick whichever fits.