Security

Each business is kept apart

One workspace per business. Every business has its own workspace at its own address. The address decides which workspace a request belongs to, and being signed in to one workspace never opens another: a person with no place in a workspace is turned away.

Who you are is never taken from the browser. Headers a browser could use to claim a business or a person are deleted before anything reads them. A request that tries to name a location, company or business itself is refused rather than corrected; which records you may reach is worked out on the server from your sign-in.

Each person sees only what they were given

Access is per person, per system, per location. The assistant can only reach the systems and locations a person has been granted. A tool for a system they have no grant to is not offered to the assistant at all, and every call is checked again on the server against that person's grants before it runs. A refused call is recorded.

A personal account stays personal. An account someone connects for themselves, such as their own mailbox, is visible only to them. Nobody else in the business, and nobody at Buckhorn, is given access to it through the assistant.

What Buckhorn staff can see. Buckhorn staff can open a client's workspace and its connected business systems to set it up and support it. That is how the service is run, and we would rather say so than imply otherwise.

Only an admin can invite. Only an administrator of a business, or Buckhorn staff, can invite someone into it, and an invite cannot hand out access to another business's records.

Credentials and changes

System credentials are kept in a vault. The keys and tokens used to reach a business's systems are stored in Supabase Vault. The application's own tables hold only a reference to them, and they are read on the server at the moment a call needs them.

Changes wait for a person, by default. When the assistant proposes changing something in a business system, the change is held until a person approves it, and every check is run again against the person approving. Proposals nobody approves expire. Approval is on for every system unless the business has asked us to turn it off for a particular system.

Every system call is recorded. Each call the assistant makes to a business system is recorded with who asked, which system, which tool and how it ended, including calls that were refused. The values sent are not stored in that record, only which settings were used.

When the assistant runs code

Code runs in a sealed sandbox. Calculations the assistant writes as code run in an isolated sandbox with no network access, no credentials, and only the files of the conversation they belong to, under time, memory and size limits.

The sandbox is tested while it runs. When the service starts, and every six hours after, it tries to break out of its own sandbox: to reach the internet, read a secret, and read another conversation's files. If any attempt succeeds, the assistant is not allowed to run code at all until it is fixed.

Internal calls are signed. Requests between the application and the service that runs the assistant are signed and expire within minutes, so the service only acts on requests the application actually sent.

Files, figures and the outside world

Files you attach stay yours. Files you attach to a conversation are kept in private storage under your business and your name, and the server confirms a file is yours before reading any of it.

Figures are checked against their source. Figures in an answer are checked against the data they were drawn from, and a figure the sources do not support is flagged rather than passed off as fact.

Looking outside the business is off unless switched on. Looking things up on the web is off unless a business turns it on, and then only for the purposes it allows. Anything found outside is labelled as outside, must name its sources, and can never become one of the business's own figures.

Nothing private is stored on your phone. Installed on a phone or computer, the app keeps only its own program files on the device. Pages, answers and files are never stored there, so a lost or handed-down phone does not carry your figures.

Who produces the answers. Answers are written by Anthropic's Claude models through Anthropic's API, using Buckhorn's own API account. To answer a question, the question and the data it needs are sent to Anthropic. The service that runs the assistant has telemetry switched off.

Scheduled jobs need a secret. Scheduled reports and other background jobs only run when called with a secret the scheduler holds, sent in a header rather than in the address.

Questions

If you need something this page does not answer, or want to report a security problem, write to tarnold@buckthetrend.co. We will tell you what we know, including when the answer is that we have not built something yet.