| Question | Product control | Review evidence |
|---|---|---|
| Who can see this? | Source-level access across records, citations and packs. | Permission and tenant-isolation tests. |
| Who confirmed it? | Owners, review history and approval for sensitive changes. | Review records and version history. |
| Is it still current? | Effective dates, review deadlines and supersession. | Source-change and conflict tests. |
| What happens after access is removed? | Retrieval blocking and invalidation of derived data. | Revocation, deletion and cache tests. |
| Where is content processed? | A declared route for each connection. | Verified data-flow documentation. |
| Can optimisation remove an important rule? | Protected instructions, diffs, approval and rollback. | Rule-preservation and rollback tests. |
| What happens when a source fails? | Partial-state reporting and resumable jobs. | Failure and recovery results. |
Choose the route your information requires.
Local Private
Device processingProcess supported private content on the authorised device. Source services retain their own original data.
Confidential Cloud
Attested workloadProcess eligible content inside an attested workload, with controlled key access and protected outputs.
Managed Connector Cloud
Disclosed processorUse a disclosed connector service for connection payloads, with connection-level consent and an explicit access scope.
Enterprise Controlled
Customer-approved boundaryAlign the processing boundary, data-plane arrangements and key controls with the agreed deployment scope.
Give important knowledge an owner and a history.
Confirmed decisions carry their owner, supporting sources and review history. Sensitive changes require an authorised reviewer. Unresolved conflicts stay visible, so the context does not quietly turn disputed information into an established fact.
Apply access rules to the evidence and the answer.
Source permissions apply across retrieved evidence, citations and generated context. Revocation and deletion invalidate derived records and cached packs under Capyba’s control. Exported copies outside that boundary cannot be remotely recalled.
Keep authority with the people responsible.
External actions require an exact destination, a preview and scoped approval. Text retrieved from a source cannot grant itself permission to send a message or broaden access.
Protected instructions, readable diffs and rollback keep changes reviewable. Partial or unavailable sources are reported as such instead of presented as complete knowledge.
Keep the exit and support paths workable.
Export and deletion controls give customers a path to retain their records or remove them. Privacy-aware diagnostics support investigation without treating private source content as routine telemetry.
Processing choices and product controls are not a claim of third-party certification. Review the relevant deployment scope, identity requirements and security evidence with the team.