Grounded answers
The knowledge agent answers only from the documents retrieved for that question. No retrieval means an honest handover to your team.
Security
Your customer conversations are the asset. We treat them that way.
This page describes controls that are implemented today. Where something is a deliberate limitation, we say so rather than leaving you to assume.
Tenant isolation
Every record — leads, conversations, messages, documents, listings, appointments, staff — carries a workspace identifier, and isolation is enforced by database row-level security rather than by application code alone. Browser sessions never receive privileged database credentials; they read and write only what their workspace membership allows. Cross-tenant isolation is covered by an automated database test suite that runs on every change.
Credentials and secrets
Provider credentials are held in the automation platform's credential store and in server-side secret storage. They are never stored in the product database, never committed to source control, and never exposed to the browser. Payment and email provider keys are restricted in scope at the provider.
Agent behaviour controls
Untrusted input
Customer messages and retrieved documents are treated as data. Instructions inside them cannot change the agent's role, reveal its configuration, or trigger actions.
Mandatory escalation
Human requests, complaints, anger, legal or financial questions and repeated low confidence stop the AI and notify your team.
Change control and auditability
Configuration changes — workspace settings, staff, agent instructions and policy rules — are recorded with the previous and new values. Agent instruction changes create a new version rather than overwriting the old one, so you can see exactly what the AI was running when a specific conversation happened. Every agent run stores its model, version, token usage, cost, latency and outcome. Database changes are forward-only migrations reviewed in source control and validated by an automated test suite before release.
Application hardening
The application is served over HTTPS with strict transport security, a content security policy, restricted cross-origin access, validated redirect targets, size and row limits on uploads, and no browser source maps in production. Every privileged server action resolves through a membership and role check, and that requirement is enforced automatically in our build rather than by convention.
Current limitations, stated plainly
- Detoximex does not hold a SOC 2, ISO 27001 or equivalent third-party certification today. We do not claim one.
- Message content is processed by our model provider to generate replies. If that is unacceptable for a specific dataset, do not load that dataset into the knowledge base.
- Data is hosted with our infrastructure providers; the specific region and retention terms for your workspace are confirmed in writing during onboarding.
- Staff replies sent from the workspace are dispatched by a recovery cycle and can take up to about a minute to leave the platform.