The companion to our Trust Center: exactly what the AI layer sees, what we store and why, and what it is architecturally prevented from doing. Same rule as everywhere else — what's true, not what sounds good.
Platform inference runs on Anthropic's Claude models over the API (Anthropic states API inputs and outputs are not used to train its models by default). Or bring your own key and inference runs on your account.
| Data | Sent to the model | What we persist | Why |
|---|---|---|---|
| Dispatch text | Yes — the text you type (plus an optional plain-text file excerpt, capped server-side) | First 500 characters, in your workspace's AI decision ledger, with the structured result, model, prompt version, and confidence | Auditability — the ledger is your record of what the model was asked and what it decided. Workspace-scoped behind RLS. |
| Semantic cache | — | The same capped excerpt + an embedding, keyed to your tenant — never shared across workspaces | Identical or near-identical requests don't re-pay the model |
| Exact-match cache | — | A hash of the input → the parsed result | Dedupe; no plaintext key |
| Your BYOK AI key | Used to call Anthropic on your account | AES-256-GCM ciphertext only — never returned to any client | Your credits, your vendor relationship |
| Risk | Our control | Status |
|---|---|---|
| LLM01 Prompt injection | Input screening (injection kernel, live at /api/v1/agent/screen) + the constitution gate on every write | live |
| LLM02 Insecure output handling | Strict structured outputs with a deterministic fallback parser + output policy check (pass · flag · block) | live |
| LLM03 Training-data poisoning | We train no models. Vendor API with a no-training default | n/a by design |
| LLM04 Model denial of service | Per-key O(1) rate limits, monthly AI budgets, and the flash-crash breaker | live |
| LLM05 Supply chain | Single AI vendor (Anthropic); registered agents carry a signed AI-BOM (bill of materials) attestation | live |
| LLM06 Sensitive data disclosure | Postgres RLS isolation, membership-gated RPCs, BYOK ciphertext never returned | live |
| LLM07 Insecure plugin design | MCP schema validation kernel + scoped, auditable fdk_ agent keys | live |
| LLM08 Excessive agency | Constitution bounds + four-eyes + simulate-before-commit + undo + authority subsetting (agent ⊆ its human) | live |
| LLM09 Overreliance | Confidence scoring, bounded auto-approval delegations with confidence floors, human approval queue | live |
| LLM10 Model theft | No self-hosted weights to steal | n/a by design |
We train no models of any kind. Platform inference uses Anthropic's API, which does not use API data for training by default.
The semantic cache and its embeddings are keyed to your tenant. Your text never warms another workspace's cache.
Every AI-created task is labeled with its method and model in the decision ledger; risky actions stop at the approval queue until a human countersigns.
An agent's authority is a subset of its human's. Scopes, rate limits, and spend caps are enforced per key — and every action lands on the signed audit chain.
Every governed action is ES256-signed and hash-chained. Verify a receipt in the browser at /verify-receipt/, or offline against the published keys at /.well-known/flowdesk-signing-key.json. Agents start at /install.md.
AI-security questions, disclosures, or an enterprise review: [email protected].