The parts your security review will ask about
Written for the person who has to sign off, not for a badge wall. Where a control is a configuration you own rather than a default we enforce, this page says so.
Built for teams whose legal team asks questions.
Both modules ship the same posture: minimal data retention, explicit field-level control over what the model sees, hardened outbound calls and an audit trail that records who touched what.
Data handling
- Live customer data is fetched on demand and held in a short-lived in-memory cache — never written to a database
- Per-endpoint field whitelists control exactly which fields reach the model
- Integration credentials are encrypted at rest and only their names appear in admin responses
- Call recordings and transcripts are stored against your organisation and nobody else's
Access control
- Role hierarchy from super admin down to support agent, enforced per request
- Optional TOTP two-factor authentication for staff accounts
- Short-lived access tokens with an explicit token type claim, so a refresh token cannot act as an access token
- Service API keys can be bound to a single organisation, and cross-tenant calls are rejected
Network posture
- HTTPS required for every registered outbound endpoint
- Private, loopback, link-local and reserved IP ranges rejected before a request is made
- The resolved address is re-validated at connection time, closing DNS-rebinding windows
- Redirects disabled on outbound calls, with per-IP and per-route rate limiting
Accountability
- Admin operations, data fetches, logins and escalations recorded with actor, action and entity
- Audit entries carry metadata only — response payloads are never stored
- Mutating agent actions are deduplicated so a retry cannot double-charge or double-file
- Every call and every ticket keeps the exact context the AI was given
How these controls map to common frameworks
These are the platform capabilities relevant to each framework, not a claim of certification. Ask us for the current attestation status during your review.
Data minimisation, on-demand fetch instead of storage, full audit trail
Access controls, audit logging, encryption in transit
No payment data stored; tokenised access only
Role-based access, audit logging, tenant data isolation
How separation is enforced in each module.
The two modules have different data models, so the guarantees are stated separately rather than blended into one claim.
Intelina Voice
AI voice agents + customer CRM
- Phone numbers resolve to exactly one organisation; a number outside your scope returns not-found rather than another tenant's agent
- Knowledge retrieval filters by organisation first and returns nothing rather than falling back to an unfiltered search
- Service API keys can be bound to a single organisation, and cross-organisation calls are rejected at the boundary
- Integration secrets are encrypted at rest per organisation and resolved only at execution time
Intelina Desk
AI chat + ticketing tool
- Every query, cache key and vector filter is scoped by project
- Widget API keys are hashed at rest and bound to a single project
- The customer's identity is derived from server-side session state, never read from the browser request body
- Live data tokens are short-lived and signed with a per-project integration secret you can rotate instantly
Defaults are a starting point, not the whole story.
These four controls do the most to reduce blast radius, and all four are yours to set.
Field-level exposure control
Name the fields an endpoint may expose and nothing else reaches the model. Configure this on every endpoint that returns sensitive data — an empty list passes the payload through rather than denying it.
Approvals for sensitive actions
Route the actions you care about through a human. The AI raises a request; a supervisor or admin approves or denies it before anything executes.
Idempotent execution
Mutating tool calls are deduplicated per conversation, so a retry returns the original result instead of filing a second claim or taking a second payment.
Metadata-only audit trail
Audit entries record who did what to which entity, along with endpoint, status and latency for data fetches. The payloads themselves are never written down.