Built like something you would let near your business

The short version: your history is never mirrored, what an employee reads for a task stays in that task's encrypted record, every action is on a permission ladder with a hash-chained audit ledger you can export and verify offline (tamper-evident by design: modification is detectable, and we do not claim cryptographic immutability), and nothing about this page is marketing-only. Each claim is product behavior.

Security claims, the mechanism behind each, and where to verify them
Claim	Mechanism	Where to verify
Raw Slack content never persists	Messages are read in flight; the pipeline drops raw content after distillation, keeping only the distilled item with provenance	Privacy policy and DPA
No irreversible action without approval	Action levels per tool operation; irreversible operations park an approval request with the arguments frozen and digest-verified	The audit trail in the app
Every employee action is logged	Append-only audit events with actor, level, and input digest	Audit export in the app (12-month retention)
Your keys, your data agreement	The model gateway runs no-training configurations on every call	Workspace model settings
Employees always disclose they are AI	In the profile, on first contact, and whenever asked; product behavior, not a setting	Any employee profile
Encrypted everywhere, credentials vaulted	TLS in transit, encryption at rest, third-party credentials in a server-side vault injected server-side only	The subprocessor list

Slack: never mirrored, kept only per task

Employees read the messages a task needs and keep them only in that task's run record: encrypted, visible to the people who supervise the employee, and kept until your workspace deletes it or for the retention period it sets. Knowledge worth keeping is distilled with provenance. Pagerox never holds a mirror of your message history.

Which channels each employee listens to is visible to the whole workspace, every channel can opt out, and ambient listening is off by default.

Pagerox and your employees read only the channels you invite them to. There is no workspace-wide crawl: you pick the channels (or every public one, once), Settings lists every channel each is in, and you can remove them from any channel anytime. Joining is quiet; Slack's own join notice says who joined.

1
Message read in flight
The employee reads the message inside the ingestion pipeline. What the employee reads for a task is written only to that task's run record, encrypted (AES-256-GCM, bound to the workspace and the run), and kept until your workspace deletes it or for the retention period it sets.
Kept: the encrypted run record, under your retention setting
2
Knowledge distilled, with provenance
Anything worth keeping becomes a distilled item: the fact itself plus provenance (source channel, author, date).
Kept: distilled item + provenance metadata
3
Raw content dropped
The original message text is discarded when the pipeline run ends. No mirror of your message history exists.
Dropped: raw message text and thread content

No mirror of your history: a task's run record and the distilled items, each deletable by your workspace.

Permissions: a ladder, not a switch

Every integration operation an employee can touch carries an action level: off, ask first, act and notify, or on its own. Anything irreversible parks an approval request a manager decides with the exact arguments frozen and digest-verified.

Autonomy is earned: levels move up through explicit manager grants, or, when a manager raises the self-evolution dial, through the employee's own improvement loop. Even then every change is versioned, lands as an FYI, is one-click revertible, and can never come from ingested content.

The self-evolution dial (L0 proposals-only by default) is manager-set and never self-modifiable. Neither are credentials, connections, spend caps, or the kill switch. Three reverted self-changes in 30 days drop the dial automatically.

Audit: immutable and exportable

Every action an employee takes is logged append-only with actor, level, and an input digest (not the raw arguments). Audit logs are retained for 12 months on standard plans and are exportable.

Models and your data

Model calls route through the Vercel AI Gateway under no-training configurations. Bring your own OpenAI, Anthropic, or Google keys and inherit your own data agreement with the provider; model costs pass through at provider rates.

Code investigations: sandboxed by construction

When an employee investigates your codebase, the investigation runs inside an ephemeral sandbox that is destroyed minutes later. Your model keys never enter it: the sandbox holds only a scoped relay token that is budget-capped, request-capped, and expiring, and can reach exactly one endpoint, our model relay. The repository clone is scrubbed of its access token before any model-driven command runs.

The worst case for a hostile repository is a burned token budget. What persists afterward is the answer, the metered usage, and a flight-recorder trace of every command the investigation ran.

AI disclosure

Employees always identify as AI: in their profile, on first contact, and whenever asked. This is product behavior, not a setting.

Encryption and infrastructure

Data is encrypted in transit (TLS) and at rest by our infrastructure providers. Third-party credentials employees use live in a server-side vault, are injected server-side only, and never appear in the database, logs, or the browser.

SOC 2 Type I is initiated at launch. This page, the data flows on it, and the subprocessor list are public from day one.

Who touches your data: the subprocessor list. The paper kit: Terms, Privacy, DPA, AUP.