Platform features

350+ sources via a managed connector catalog, plus first-party OAuth connectors for Gmail, Google Drive, Google Contacts, Notion, Confluence and HubSpot. Connections are tenant-level and granted to specific workspaces, so one authorisation can serve several teams without over-sharing.

PDF, DOCX, XLSX, CSV, TXT, Markdown and images. Scanned PDFs and images go through OCR automatically. Extraction handles tables and formulas, not just flowing text.

A universal endpoint for text, markdown, HTML, JSON and code, with automatic, manual or hybrid routing to a department.

Transcription and speaker diarisation are specified but not built.

Vector, graph, episodic and cache engines in parallel, reranked, then synthesised with inline citations. Sources are emitted before the answer on the streaming endpoint.

Retrieval is dense-vector only today. Exact-token recall — part numbers, error codes, identifiers — is the known weak spot, and sparse retrieval is the fix.

Continuous cross-source entity resolution on every write, with a human review queue for ambiguous pairs.

Value, numeric and temporal conflicts surfaced with a four-way resolution and a full audit trail.

Nightly A–F grade over freshness, coverage, connectivity and coherence, per memory and per department.

Compiled per-entity profiles are live; automatic ranking of syntheses inside search results is not yet wired.

Five roles and fifty-plus granular permissions, with resource-scoped grants. Revoking access takes effect immediately rather than waiting for a token to expire.

Every privileged and destructive action recorded immutably, tenant-scoped, with a trace id that correlates the action across services. Credentials are never written to it.

Secrets and PII detected, classified and masked at the value level before storage and before any model call. Fail-closed.

Whole-tenant purge exists. Selective per-record erasure does not — do not plan a compliance programme around it yet.

Platform keys and per-memory keys, with scopes, IP allowlists, expiry, rotation with overlap, and revocation that hits the gateway before the database.

Client-credentials applications for machine-to-machine access.

Memory and space endpoints with a full OAuth 2.1 authorization server — discovery, dynamic client registration and a consent screen — so modern clients connect without a pasted key.

Outbound delivery with HMAC signing, exponential retry and a dead-letter queue.

Python and TypeScript exist and work. There is no Go SDK, no CLI, and no auto-generated client — those are roadmap.