Security
Security your reviewers can check.
Poh works inside your people’s Deep Thought roles. Every action is checked before it runs and recorded after, and your data is never used to train models.
The controls
- Permissions
Denied unless allowed
Deep Thought roles are checked on every action, and any deny wins. IMS methods outside our approved list cannot be enabled by anyone.
- Audit
Every action recorded
Each AI action, tool call and permission decision is logged with per-entry tamper-evident hashing, plus an external signed checkpoint that detects later changes.
- Credentials
Secrets the AI never sees
Stored credentials are encrypted with AES-256-GCM, with the master key held in Azure Key Vault.
- AI data
Zero data retention with Anthropic
A zero-data-retention agreement with Anthropic, web search and fetch at zero retention by default, and no training on your data.
- Files
Scanned before they are read
Microsoft Defender scans every file uploaded, emailed or pulled from your systems before the AI opens it.
- Isolation
Your tenant, kept separate
Tenant isolation is enforced in the application and in the database with row-level security.
- Lifecycle
Your data, on your terms
Retention windows set for each tenant, legal hold, full export and audited offboarding.
- Sign-in
Your identity provider
Single sign-on with Microsoft Entra, Okta or any OIDC provider, with directory groups mapped to roles.
What happens when Poh acts
Every request goes through these checks, whether a person asked or an automation started the work.
Request
A person asks, or an automation starts.
Permission check
Deep Thought roles are checked; any deny stops it.
Approval
In a conversation, changes to your policy system, outgoing email and writes through Connections wait for an Approve card. An automation runs on the approval its owner gave when setting it up.
Runs on the right login
IMS changes run on the person’s own login, or the automation owner’s. Databases and company APIs use the logins an administrator granted.
Recorded
The action and its outcome land in the audit log.
Send us your security questionnaire.
We'll answer it with the policies and evidence behind each control.