The system of record.
Desktop sync folder
Drop files in a folder on your desktop; they upload with resumable, verified transfers. Browsing and downloads happen through the web — your disk stays clean.
Full-text search
Bounded keyword retrieval over document text with page-number citations, plus type, date and size filters. Vectorless by design — you can always ask why a result ranked.
AI category labels
Files classify themselves against your department's curated taxonomy the moment they land. No fit → flagged for a person, never silently misfiled.
Version history
Replace a file and the outgoing version is captured server-side, first. Forward-only, nothing deletes a version, and restoring re-captures the displaced state.
Trash & restore
Deletes are 30-day tombstones. Restore a whole subtree with keep-both naming — nothing overwrites anything silently.
Thumbnails & preview
Images and PDF first pages render as thumbnails and an in-app preview page — wall-checked like every other read.
The agent platform.
Assistant with citations
Ask in plain language; get answers drawn from your own documents with page-level citations and a files card listing every source used.
Workflow compiler
Describe automation in plain English → a declarative JSON spec with a fixed verb vocabulary (summarise, notify), reviewed before activation, audited at every firing.
Organizer proposals
The agent proposes file moves, renames and relabels with evidence — a manager approves, and nothing moves until a human says so.
Scheduled digests
Weekly personal catch-ups, manager digests (flagged backlog, unanswered searches) and monthly tenant reports — compiled through the department wall, without an LLM.
Knowledge graph
People, organisations and places extracted from your documents fold into a wall-scoped graph view — co-occurrence you can inspect, not similarity scores.
MCP for AI clients
Cursor, Claude Code and other MCP clients connect with a personal access token and get search + ingest tools scoped to that person. No delete tool, deliberately.
Built for the people who answer for it.
Department walls
Members search and read only their department's documents — enforced on every read surface, including the assistant, digests and the graph.
Hash-chained audit log
Every change to people, files, links and settings lands in a tamper-evident chain — verified on demand, exportable as CSV.
Usage ledger
Every model call — classify, summarise, extract, answer, compile — is metered with its purpose and visible in your console.
Quota enforcement
Storage allowance derives from seats and is charged atomically at every byte-writing step — concurrent uploads can't race past it.
Webhooks
Timestamped HMAC-signed events for file lifecycle, bounded retries, per-endpoint delivery log — with private-network targets refused by default.
Ransomware anomaly alerts
A velocity scan over the changes journal raises one owner alert per actor per cooldown when deletion or rewrite patterns spike.
See the pipeline for yourself.
The simulator narrates the real stages — or read how the pieces fit together.