From chat message to your data

01Identity

Explicit owner list. Everyone else is a member, and the bot never guesses.

02Zero-tool sandbox

Members get snapshot answers only. No Sheets access, no shell, no files.

03Rate limits

6 per person per hour, 150 per group per day, 10-second cooldown.

04Scrubbed routing

Only cleaned text reaches the decision model. No names, no numbers.

05No deletes

Rules block deletes and protected columns. Google version history is your undo.

Data flow

What leaves your sheet, and what never does

Your sheet stays in Google. The bot keeps a 30-minute snapshot to answer members.
Only scrubbed text reaches the decision model: no names, numbers or links.
Owner writes go through the Sheets connection and are shown back as the exact row.
Drive retrieval is file-level, by subject, from a local index you control.
Logs pseudonymise member ids.

Member message

↓ identity check

Zero-tool sandbox · snapshot

↓ rate limit · cooldown

Grounded answer with citation

owner path only ↓

Sheets write · no deletes · version history

Honest status

What we do not claim yet

No SOC 2 or ISO 27001 yet. We will pursue them when the hosted product has paying customers. Enterprise plans get a data processing agreement and a private deployment today.

WhatsApp on the self-hosted version uses an unofficial gateway (WAHA). It can get a number banned. Hosted plans use the official WhatsApp Business API; Telegram is official everywhere.

Retrieval is file-level, not embedding search. /prep picks the right files by subject and section. Semantic search across every page is on the roadmap.

Uptime target, not SLA, below Enterprise. Business plans target 99.5%. Enterprise gets a written SLA.

Ask us a security question