Our approach
Trust should be legible.
Robin combines verified identity, server-resolved organization and project authority, tenant-filtered data access, organization-owned provider connections and human review for consequential writes.
Firestore projection recovers through authorized SQL and REST truth.
- 01 Identity is checked.
- 02 Tenant scope is resolved.
- 03 Consequential action is reviewed.
Security is resolved on the server
Robin combines verified identity, server-resolved organization and project authority, tenant-filtered data access, organization-owned provider connections and human review for consequential writes. Client-selected organization identifiers do not establish authority.
Tenant and project scope stay distinct
Organization and project scope are resolved server-side and applied to SQL and provider operations. An imported person, authenticated user, membership, project access and future licensing are separate concepts rather than interchangeable forms of authority.
Connected credentials remain server-side
Provider credentials are encrypted at application level in PostgreSQL, decrypted in server memory for provider calls and excluded from model, UI and log content. Provider reads also remain constrained by the organization connection and granted scope.
Robin does not claim per-tenant encryption keys or customer-managed key support as a completed capability.
Canonical data and bounded projections
PostgreSQL is canonical business state. Firestore is a non-authoritative realtime projection, and clients recover through authorized SQL and REST truth. Source adapters normalize bounded results; raw provider payloads and secrets are not model, UI or log content by default.
Ordinary business rows rely on cloud and database encryption at rest plus IAM and application controls, not universal application-field encryption. Retention and user-rights statements remain owned by the approved Privacy Policy.
Tool calls do not confer authority
A model tool call does not independently authorize an external change. Meaningful provider writes require the applicable human-approved proposal and worker reauthorization, while roadmap revisions preserve versioned review or explicit authorized application semantics.
Security is an operating obligation
Security is ongoing work: design carefully, operate with discipline, review evidence and improve controls as the system changes. This page describes current boundaries without certification badges, absolute compliance conclusions or claims that risk can be eliminated.
Read the governing documents
Continue to the approved Privacy Policy, inspect the provider-specific integration boundary, contact Robin with a security question or discuss the authorization model for a potential design partnership.