Your data is structurally isolated.
Most platforms enforce account isolation by convention, with a filter someone remembered to write. Dexor enforces it by construction. There is exactly one path to the database, and it refuses to touch another account's data.
Every request goes through one gate.
Every request reaches storage through a single account facade bound to the verified account claim in the login token. It refuses any key belonging to another account (including cross-company index-projection attacks) before the request ever reaches storage. Isolation isn’t a policy we follow; it’s a property of the architecture.
- Own-account keyallow
- Foreign-account keyrefused
- Cross-account GSI projectionrefused
Two doors, separately locked.
Customers authenticate against their own identity pool with an immutable account ID and SRP-only sign-in. Dexor’s own staff use a completely separate platform pool that requires TOTP multi-factor authentication. Suspended accounts receive nothing, not even live push traffic.
- Customer poolimmutable account ID, SRP-onlyisolated
- Platform poolDexor staffTOTP MFA
- Suspended accountno traffic
If it can't be recorded, it doesn't happen.
Every control-plane change (provisioning, targets, org moves, match decisions, settings) is written to a tamper-evident audit trail with a frozen six-field body, kept for seven years. If the audit channel is unavailable, the route fails closed before any write, and most changes commit their audit row in the same transaction as the data. Admins can export the trail as a CSV.
| When | Who | Action |
|---|---|---|
| 21 Oct 2026, 10:42 | u-4e1c9a admin | account.period.close |
| 21 Oct 2026, 09:58 | u-4e1c9a admin | account.user.suspend |
| 20 Oct 2026, 17:21 | u-1f07c3 manager | account.plans.approval |
| 20 Oct 2026, 15:06 | u-1f07c3 manager | account.sales.reproject |
| 20 Oct 2026, 11:40 | u-4e1c9a admin | account.settings.update |
Try a different term, or load more of the trail.
The AI inherits the boundary.
Dexor’s AI is scoped by the caller’s token, never by a tool argument, so it is structurally incapable of reading outside your subtree, let alone another account. Prompts carry aggregate figures. Dexor manages the AI cost controls, and a code-level allowlist means no one can route your data to an arbitrary model.
- Scope derived from tokenstructural
- Scope passed as tool argignored
- Prompt payloadaggregates only
- Arbitrary modelallowlist blocks
Tracking with consent, retention, and an off switch.
Location is opt-in per rep; a rep who declines consent is never GPS-tracked. Route points carry privacy retention TTLs. Visit photos live behind account-isolated keys and short-lived signed URLs. Only entitled users inside the subtree can open them, and anyone else is denied by zero-trust RBAC. Location modes (off, mandatory, opt-in) are set per account to match your policy and law.
- Consent declinednever tracked
- Route pointsretention TTL
- Unauthorized photo accessoutside the subtree, not entitledaccess denied
Built to stay up.
Serverless throughout, with no always-on servers and point-in-time recovery on the datastore. AI inference fails over automatically from the primary provider to the direct Claude API during an outage or throttle, and the AI tier is separately tearable: switch it off entirely and core dashboards keep working. Prompts carry aggregate figures only.
- Serverless, PITR datastoreno servers
- Primary provider outage → Claude APIfailover
- AI tier off → core survivestearable
- Prompt payloadaggregates only