Customer developer docs

Customer data handling

Tenant isolation, data minimization, read-only boundaries, and model use.

Customer data handling

Tenant isolation

Vault is the system of record, and every tenant's data is isolated. Runs, stage events, exceptions, reviews, receipts, artifacts, and the audit ledger live in per-tenant databases (or dedicated per-tenant schemas), routed through per-tenant credentials resolved from a secret manager at runtime. The Merkle ledger, its checkpoints, and the receipt chain are all per tenant — there is no cross-tenant evidence structure.

Data minimization

  • Runs bind to immutable source snapshots identified by content hash. Receipts and evidence references carry typed opaque IDs plus sha256: content hashes; row-level values and source-system identifiers are not accepted in a receipt.
  • The agent runtime is stateless: it holds no database, never stores source documents, and receives only the declared fields a task needs — never whole rows, connection descriptors, or credentials. Source rows and payloads are not logged.
  • Uploaded files go directly to object storage; Vault does not proxy file bytes through application memory.
  • Secrets — database passwords, transport keys, integration credentials, API keys — live in the configured secret manager. Tenant API keys are stored only as HMAC hashes.

Read-only by design

Integrations use read-only credentials. Definite never writes to a source system, never initiates a transaction, and never files on your behalf. Mutating operations inside Definite (reviews, approvals, final exports) require a named, authenticated human actor through the console; tenant API keys are read-only for export authorization.

Model use

Agent tasks run against an approved per-tenant model catalog through cloud provider endpoints. Client data is never used for model training. Model involvement is disclosed in run telemetry and result manifests; a result whose model involvement cannot be attributed is treated as unverified, not trusted.

Your controls

Your admins manage members and roles, API keys, notification and export destinations, two-factor authentication, and (for enterprise tenants) SAML SSO and SCIM provisioning. Data leaves Definite only through surfaces you configure: console exports, the API, decision streams, SIEM exports, and webhooks.