Your data is structurally isolated.
Most platforms enforce tenant isolation by convention — a filter someone remembered to write. Dexor enforces it by construction: there is exactly one path to the database, and it refuses to touch another tenant's data.
One gate. No exceptions.
Every request reaches storage through a single tenant facade bound to the verified tenant claim in the login token. It refuses any key belonging to another tenant — including cross-tenant index-projection attacks — before the request ever reaches storage. Isolation isn’t a policy we follow; it’s a property of the architecture.
- Own-tenant keyallow
- Foreign-tenant keyrefused
- Cross-tenant GSI projectionrefused
Two doors, separately locked.
Customers authenticate against their own identity pool with an immutable tenant ID and SRP-only sign-in. Dexor’s own staff use a completely separate platform pool that requires TOTP multi-factor authentication. Suspended tenants receive nothing — not even live push traffic.
- Customer poolimmutable tenant ID · SRP-onlyisolated
- Platform poolDexor staffTOTP MFA
- Suspended tenantno traffic
If it can't be recorded, it doesn't happen.
Every control-plane mutation — provisioning, targets, org moves, match decisions, settings, even PII reads — is written to a tamper-evident audit trail with a frozen six-field body. If the audit channel is unavailable, the route fails closed before any write; data and audit commit atomically. Admins can export a de-identified CSV with SHA-256-hashed IDs.
- Mutation + auditatomic
- Audit channel down → routefails closed
- Export · SHA-256-hashed IDsde-identified
The AI inherits the boundary.
Dexor’s AI is scoped by the caller’s token — never by a tool argument — so it is structurally incapable of reading outside your subtree, let alone another tenant. Prompts carry aggregate figures. Every model call passes an atomic budget check first, and a code-level allowlist means no one can route your data to an arbitrary model.
- Scope derived from tokenstructural
- Scope passed as tool argignored
- Prompt payloadaggregates only
- Arbitrary modelallowlist blocks
Tracking with consent, retention, and an off switch.
Location is opt-in per rep; a rep who declines consent is never GPS-tracked. Route points carry privacy retention TTLs. Visit photos live behind tenant-isolated keys and short-lived signed URLs — only entitled users inside the subtree can open them, and anyone else is denied by zero-trust RBAC. Location modes — off, mandatory, opt-in — are set per tenant to match your policy and law.
- Consent declinednever tracked
- Route pointsretention TTL
- Unauthorized photo accessoutside the subtree · not entitledaccess denied
Built to stay up.
Serverless throughout — no always-on servers — with point-in-time recovery on the datastore. AI inference fails over automatically from the primary provider to the direct Claude API during an outage or throttle, and the AI tier is separately tearable: switch it off entirely and core dashboards keep working. Prompts carry aggregate figures only.
- Serverless · PITR datastoreno servers
- Primary provider outage → Claude APIfailover
- AI tier off → core survivestearable
- Prompt payloadaggregates only