Company data stays the company's.

Agent permissions

An agent can only do what the person who started it may do. Anything leaving the company waits for approval.

• Approval before anything leaves: an email, a file, an order. The agent prepares it, the manager presses Approve.
• Never more than the person: if Maria may not send, neither can the agent she started, even with an approval.
• Roles per company: Owner, Admin, Member, Guest and your own roles, per team and project.

What we don't do: no company agent sends anything out on its own while approvals are on. They are on by default.

Data isolation between companies

Each company has its own memory and its own keys. Nothing crosses from one company to another.

• One encryption key per company for its memory (AES-256). Text encrypted for one company does not open for another.
• Requests signed per company: a request signed for Casa Verde is refused for Polonic, even on the same computer.
• Enterprise: the company's memory lives in its own separate database, with its own backup.

What we don't do: we don't use one company's data for another, or pool it to "learn" anything.

A complete action log

Who asked, which agent worked, on which computer, who approved. It all stays on record.

• Can't be rewritten quietly: every row is chained to the one before; a changed or deleted row breaks the chain and the check shows exactly where.
• Search and export: by person, action and date; CSV or JSON export, verifiable on your side.
• Into your security system (SIEM), in real time, signed.

What we don't do: the log does not keep chat text, only who, what and when.

Backup and restore

Hosted by us: a backup every night, encrypted, off the server. Self-hosted: everything stays with you.

• Every night at 03:30: the hub's data and the company memory, encrypted before they leave the server.
• Restores are tested, not assumed. If a night's backup is missing, we get an alert.
• Self-hosted: the hub's data lives in files on your server; copy them wherever you like.

What we don't do: we don't keep copies forever: 30 days of dailies, then one a month for 12 months.

Employee access control

Everyone sees and does only what their role allows. New computers get in only with approval.

• Two-step verification required for owners and admins; passkeys with fingerprint or face.
• Devices you approve: a person's first computer on the company server waits for approval. Sessions can be closed remotely.
• Follow without touching: employees give tasks to the company's agents and follow them read-only.

What we don't do: members don't type directly on the company computer; only the company's agents and admins work there.

Protection against prompt injection

An outside email or document may try to give the agent orders. To the agent, it is just text to read.

• Data, not instructions: incoming emails are marked untrusted; the agent won't follow requests for passwords, payments, new bank details or sending data out.
• Flags for the manager: hidden text, a link that goes somewhere else, a sender that fails verification.
• Approval on anything leaving: even if a message fools the agent, nothing goes out without a person.
• Memory takes no orders from outside: outside content is saved as an unverified observation, and a new rule waits for you to confirm it.

What we don't do: we don't let an email trigger a payment, a send or a reply on its own.

When an agent gets it wrong

Agents sometimes get things wrong. We build so you see the mistake before it leaves, and can undo it.

• Nothing leaves without approval, so you catch the mistake, not your client.
• Versions: documents open in Zen Staff keep the old version on every save (the last 20). One click to go back.
• Accounting: the agent marks unsure rows and checks net + VAT = the document total. You check only the marked rows, not all 200.

What we don't do: we don't promise 100%. We promise you see what's unsure before it matters.

coming soon A version kept before every change an agent makes, in any folder.