Security & trust
Get out of email
Most approval risk is not exotic. It is a decision made in a thread, by someone who may not have been allowed to make it, that nobody can reconstruct a year later. Branchsolve replaces that with one place, one record, and one answer to “who approved this?”
Approvals never travel by email
There is no approve-by-reply link, so there is nothing to forward, spoof or click by mistake. Notifications point at the request; the decision happens against a verified identity.
Opening is not deciding
A link preview, a crawler or a corporate link scanner can open a notification and change nothing. Deciding takes a deliberate action from someone signed in.
You cannot approve your own request
Separation of duties is enforced by the engine, not left to whoever wrote the workflow. Nobody decides twice on the same pass either.
Decisions are append-only
Nothing rewrites a decision — not an administrator, not support, not us. A correction is a new decision with its own actor and timestamp.
An AI's decision is labelled as one
When a workflow assigns a step to an agent, that decision is recorded as a distinct actor class. It is never presented as though a person made it.
One workspace cannot see another
Every piece of customer data is stored under its organization, and the data layer takes the tenant boundary at construction — no query method accepts an organization id at all.
AI access
The assistant is not a back door
Connecting Branchsolve to an assistant or model provider is the part security teams ask about first, so it is the part built most carefully.
- AI-assisted authoring passes through one gateway that names the workload, purpose, provider and exact model before any provider call.
- Data connections and reusable capabilities are separate proofs. A healthy account connection does not unlock a provider catalog: Branchsolve exposes only explicitly published, version-pinned operations whose scopes, account mode and live health match that workspace.
- Usage accounting stores token totals, an immutable price snapshot and a hashed correlation—not complete prompts, responses, credentials or provider request identifiers.
- A workspace has exactly one explicit AI choice: included funding, one tested customer credential, or disabled. A missing, unhealthy or revoked credential fails closed and never falls back.
- Customer AI credential values are accepted once into server-only secret storage. Firestore and customer screens contain only an opaque vault reference, bounded fingerprint, provider, health and audit metadata; only a recently signed-in owner can manage them.
- The AI provider boundary is separate from data connections. A model never receives a Composio key, connected-account identifier, unrestricted catalog or execution authority.
- Automation authoring gives the model only eligible Branchsolve operation IDs, friendly business fields, risk and bounded mapping vocabulary. Provider tool names, account selectors, raw schemas and approval authority stay server-side.
- A proposal, preview or simulation cannot activate or execute. Initial activation and semantic replacement require a recently signed-in owner to confirm the exact immutable proposal revision and hash.
- Capability research, import, comparison and preview cannot run a provider operation. Publication is an explicit operator action, and each workspace owner still accepts their own connection binding and workflow.
- A connection acts as the person who made it, never as the organization. There is no shared workspace token.
- A granted scope can only narrow what that person's role already permits. It can never widen it.
- Every call re-reads live membership, so suspending someone stops the next call rather than waiting for a token to expire.
- Authorization uses OAuth 2.1 with PKCE, rotating refresh tokens and single-use codes. Replaying a code retires the whole token family.
- Administrative and authoring permissions are not in the default grant. Reaching them requires a separate, explicit step up.
Questions from security reviews
Where is our data stored?
In Google Cloud, under your organization's own document tree. Client applications are denied all direct write access by security rules, so every change goes through the server, where the tenant and the actor are both re-derived.
What happens when someone leaves?
Suspending them keeps every record while closing their session, their client access, their connector token, their upload links and their notifications. The delivery worker re-checks live membership before every send, so an ex-employee's phone stops buzzing.
Can a Branchsolve operator read our workflows?
No. An operator can create and suspend organizations. The control plane returns an operator identity and nothing else — no repository, no organization, no customer content — so an operator page cannot fall through into a workspace.
How are file attachments handled?
Documents live in cloud storage that denies every client directly. Uploads carry a single-use token issued by Branchsolve, downloads re-derive who is asking, and only participants on that request can read them.
Do you have SOC 2?
Not yet, and we would rather say so than imply otherwise. Tell us what your review needs and we will answer specifically — get in touch and pick “Security review”.