The AI never holds a credential.
An agent that acts inside your product reads web pages it cannot trust and talks to strangers. Everything on this page follows from taking that seriously: a hard boundary between what the AI suggests and what actually happens, and a record you can read of everything that did.
The AI proposes. A separate service decides.
The model never calls your API. It writes down what it wants to do, and a piece of ordinary, non-AI software checks that request against your rules before anything happens.
Credentials
Best: your app issues a short-lived, narrowly scoped token for each session. Alternative: you store one service credential with us, encrypted with a key unique to your account, and each call carries the user it acts for. Either way, the credential exists only inside the checking service, is never logged, and is scrubbed from every error.
Identity
Actions exist only for users your own server has vouched for, with a signature only your server can produce. The chat window cannot claim to be someone; a bad signature is refused outright.
Off until you say so
Import your API and every action starts switched off. You enable them one at a time in your dashboard. Actions we cannot classify with confidence wait for a person to look at them.
Three kinds of action, three levels of care
- Lookups run when asked, within limits per session and per day.
- Changes show a confirmation card with every field that will change, before anything is sent. The confirmation is tied to that one user, that one request, and expires.
- Irreversible actions, such as cancel, refund, delete or anything moving money, are off for your whole account by default. When you enable them, they need the card too, and the full before and after state is recorded.
- A retried request is recognised and refused, so a timeout can never turn into a double booking or a double charge.
An audit trail nobody can edit
Append-only, including for us. You read it in your dashboard, filter it by action, person or conversation, and export it.
Each entry says who acted (a user, one of your team, our service, or one of our staff), what they did, on what, the state before and after, the reason when one was given, and a reference to the conversation it came from. If our staff ever need to look into your account, they must give a written reason, and it appears in your trail with that reason.
A web page cannot give it orders
The agent reads your site and, on some products, text your users wrote. We assume some of it is trying to trick it.
- Everything it reads is marked as untrusted, and it is told to treat instructions inside as text, not commands.
- The defence that matters does not depend on the AI behaving: the checking service applies your settings and the confirmation rules whatever the model decided. A successful trick can produce a bad suggestion, never a completed action.
- Links in answers only go to domains you registered.
- Every blocked attempt is recorded, and the rate is on your dashboard, because a rise is the first sign someone is probing.
Strangers cannot spend your money
- The widget only works on the domains you registered, checked on our side.
- Limits per conversation, per visitor, per site and per account, by the minute, hour and day.
- A daily spending cap for your account with a hard stop. When it is reached the agent closes politely and offers a person.
- A bot check only on unusual patterns. Regular users never see it.
- Visitors who are not signed in get the lighter model and no actions.
Encrypted, redacted, and deleted on schedule
- Customer data is hosted in the European Union (Frankfurt), where the agent runs too. Every provider that touches it is listed below.
- Transcripts are redacted before storage: card numbers, bank details, emails, phone numbers, addresses. The original is encrypted with your account's own key; revealing it is a deliberate, recorded action by an administrator.
- Retention is your setting, 90 days by default, with hard deletion, plus a deletion request you can trigger yourself.
- Your secrets, such as API credentials, are encrypted with a key unique to your account and never shown again beyond their last four characters.
- Your data is never used to train models. It reaches the AI providers listed below only for the current conversation, under the data processing agreement.
The paperwork, before it blocks a deal
- A data processing agreement, the sub-processor list and a deletion endpoint are available before your pilot starts.
- The agent discloses that it is AI on first interaction, ahead of AI transparency rules wherever it runs.
- It works when analytics consent is declined: no third-party cookies, no tracking pixels.
- Security questions and reports: security@actessia.ai.
Who else touches your data, and what they see
| Provider | Purpose | Location | What they receive |
|---|---|---|---|
| Supabase | Database, dashboard sign-in, file storage | EU (Frankfurt) | All customer data at rest, encrypted. Your data is encrypted with keys that only we can unwrap, not the host. |
| Anthropic | The AI model behind answers and actions | United States | Receives the conversation and the passages retrieved for it. Never a credential. No retention of content. |
| Voyage AI | Turning documents into searchable form | United States | Receives document excerpts and questions. No user identity. |
| Stripe | Billing, invoices, EU VAT | EU / United States | Your billing details and payments. Never any conversation data. |
| Application hosting | Runs the agent and the layer that calls your API | EU | Named precisely in the list you receive with the data processing agreement; 30 days' notice before any change. |
| Transactional email | Hand-off emails and billing notices | EU | Named in the same list. |
What it will never do
Each of these is enforced by the checking service, not by asking the AI nicely. Each refusal is one plain sentence to the user and one row in your audit trail.
- Take any action for a visitor who is not signed in.
- Run an action you have not switched on, however the request is phrased.
- Change anything without showing the user a confirmation card and getting a yes.
- Cancel, refund or delete while that class of action is off for your account.
- Perform the same change twice because a request was retried.
- Place your users' credentials, or yours, in front of the AI model.
- Send a user to a link outside the domains you registered.
- Show a user an error dump. A refusal is one plain sentence, and one row in your audit trail.
Engineers who want the exact checks, the signing scheme and the refusal reasons will find them in the technical security model.
Put it in front of your security review.
The data processing agreement, the sub-processor list and the technical security model are yours before the pilot starts. Bring your hardest questions to the first call.