Communication you must be able to explain

What is on the record#

The decision

The audit trail carries what was decided, by what, under which rule, and the outcome. A refusal is recorded on the same footing as an action.

The approval

Held actions are released by a named person with permission on that channel, and the decision log answers 'who released this' long after everyone has forgotten.

The evidence behind a claim

In prospecting, a claim without evidence does not reach the record at all. The source is attached to the claim rather than remembered alongside it.

The send

A message is reported as sent only once the provider acknowledges it. The third state — uncertain — is shown as uncertain rather than resolved by guessing, because a confident wrong answer here is the one that causes trouble.

The file

Connect creates and modifies files as new versions, with provenance and audit, so the document somebody objects to has a history rather than a single mutable state.

The refusals that protect you#

Most of the compliance value here is negative — things that do not happen, reliably, without anybody remembering to enforce them.

• No invented commercial term. A price, an SLA or a warranty Knowledge cannot support is refused and escalated. On the realtime voice path the rule can only live in the instructions, so a breach is detected rather than prevented: price_spoken counts the lines the voice priced, using the same expression the carrier path checks each sentence with.
• No guessed contact details. No pattern-generated email address is produced, tested or sent to.
• No quiet override of a do-not-contact entry. Suppression, unsubscribe, complaints and do-not-contact are checked in one place before any outreach, and the Assistant cannot clear a do-not-contact entry at all.
• No cross-workspace leak by accident. Isolation is enforced three times: the tenant allowlist in the middleware, the SQLAlchemy workspace kernel, and row-level security in PostgreSQL, forced on every scoped table.

Handling the messages themselves#

Two things about reading mail matter more in a regulated setting than elsewhere. HTML is sanitised aggressively before it is rendered, and remote images are proxied rather than fetched by the reader browser — so opening a message does not tell the sender that somebody opened it.

Files are read with the standard library: PNG, JPEG and WebP; PDF via its text layer, or read by the model when there is none; DOCX; XLSX; CSV and TSV; PPTX; TXT, MD and JSON. DOCTYPE and ENTITY declarations and zip bombs are refused, which closes the two attachment tricks that turn a document reader into an incident. CSV export neutralises formulas so an exported sheet cannot execute in somebody spreadsheet.

What this documentation does not claim#

Where the credentials live#

Provider credentials are sealed on every save and never echoed back to a screen. Google OAuth is the only sign-in — there is no password login to leak or to leave behind when somebody departs. The database password is not held in configuration at all: the managed database rotates the master credential into a secrets store, and boot reads it from there by ARN.

The application own machine-readable API description is closed and stays closed; the public description that exists is published deliberately, separately, and does not expose the internal surface.

Questions#

Related#

• Security and isolation
• Three independent layers of tenant isolation
• What Connect may do
• Files and data in Connect
• Professional services enquiries
• Prompt injection arrives as ordinary business mail