Safe, secure, and private.

Tenant isolation is enforced through physical process separation, not logical application flags. Every agent session executes inside an ephemeral Cloudflare Sandbox Container provisioned per tenant and per matter. Untrusted tool execution, Python evaluation, and file parsing occur entirely within these zero-trust container runtimes over mutual TLS HTTP contracts. Agent scratchpads, dynamic context assemblies, and working directories are wiped upon container termination. At rest, persistence is logically and cryptographically partitioned via Neon PostgreSQL with table-level row-level security (RLS) enforcement and tenant-scoped KMS encryption keys. No agent possesses ambient, cross-tenant, or global firm memory.

Reasoning models and autonomous agent loops never receive, inspect, or hold production API tokens, OAuth refresh secrets, or banking credentials. All third-party secrets for upstream ledgers, such as QuickBooks Online, and banking rails are isolated inside dedicated, hardware-secured action gateways. Agents resolve domain tasks by emitting strictly typed, schema-validated command envelopes, for example PostJournalBatch or PrepareFilingReceipt. The action gateway authenticates caller origin, validates schema integrity, and signs outbound API transactions using short-lived credentials. The agent decides the intended operational outcome; the gateway enforces whether that outcome is authorized to execute.

Nimble & Cross operates an asynchronous dual-agent supervisory topology. Operational agents are structurally barred from evaluating or approving their own execution boundaries. Every command envelope generated by a worker agent must pass through an independent Sentinel Gatekeeper prior to execution. The Sentinel parses incoming and outgoing traffic against deterministic rules: transaction limits, counterparty allowlists, anomaly bounds, and chart-of-accounts mapping parameters. Any high-risk, irreversible, or out-of-policy action, such as an unmapped account entry, a tax return transmission, or a fund disbursement, immediately triggers an execution hold. The underlying Restate workflow pauses, and a structured diff is dispatched to authorized human personnel for explicit sign-off. A non-deterministic model cannot grant itself authority or bypass Sentinel controls.

Data minimization is a structural protocol enforced at the gateway perimeter. When an operation requires external transit, such as transmitting invoices, calling banking partners, or submitting regulatory filings, the outbound proxy strips all extraneous context. Outbound payloads contain only the exact fields strictly required by the destination schema. The operational case graph, intercompany ledger history, internal chat transcripts, and adjacent client identifiers remain contained within our encrypted core. Downstream providers receive transactional data without access to the broader client context.

Operational verification is continuous and retrospective. During scheduled maintenance windows and idle runtime cycles, automated stewardship daemons execute background reconciliation passes across all active client accounts. These reflective loops audit past agent actions against source evidence, verify mathematical balances across subledgers, and detect configuration drift or mapping discrepancies. When an inconsistency is detected, the daemon flags the batch, quarantines the affected ledger slice, and alerts internal controllers. Corrections are applied exclusively through forward-correcting journal entries, ensuring historical audit records remain immutable.

Language models handle unstructured interpretation, but authoritative financial records are governed by deterministic database state machines. The Nimble & Cross core ledger runs on Neon PostgreSQL, coordinated through Restate durable execution engines. The ledger enforces double-entry rules at the database engine level via strict constraint triggers: every journal batch must balance to zero in the base book currency across all debits and credits before committing, posted journal lines and batches become append-only and immutable and reject all SQL updates and deletes, and closed accounting periods enforce explicit period-lock triggers that block backdated entries. If an agent emits an unbalanced or malformed batch proposal, the PostgreSQL transaction aborts automatically. A generative model cannot override these database constraints.

Client data is never used to train, evaluate, or fine-tune public or proprietary base models. We operate under strict enterprise zero data retention (ZDR) agreements across all inference endpoints. Prompts, document payloads, and context windows reside exclusively in volatile memory for the duration of the inference call and are immediately flushed. All persistent assets, invoices, receipts, corporate filings, and generated work products, are stored immutably in content-addressed object storage, verified via cryptographic SHA-256 hashes.