Security & control

What the agent can and cannot do

The most important control in this product isn't a certificate — it's that Quartermaster has no ability to act on its own.

• Every tool the agent can call is either read-only or creates a pending proposal. There is no tool that places an order, sends a message, or changes stock directly.
• Proposals wait in the Action Queue until a person approves them. Rejecting one discards it entirely.
• Spending above your threshold requires two different people to approve — the person who approves first cannot also confirm.
• Auto-approval is off by default. When switched on, it is bounded by an amount cap, a minimum supplier on-time rate, and a probation window that excludes suppliers without a real track record. Any supplier can be excluded outright.
• The exact wording of every email and agreement is shown to you before approval, and that wording is what is sent.
• A call is different. You approve its purpose and the script the voice assistant is given. Every call opens with a fixed line that says the caller is an AI and that the call is recorded and transcribed, and the assistant then speaks live, so its words after that are not fixed in advance. The recording and transcript show what was said.
• The agent is instructed never to invent a supplier or its contact details, and never to fabricate legal terms it has no basis for.

Access control

• Four roles: Admin, Approver, Member, and a read-only Auditor for people who need visibility without the ability to change anything.
• Optional two-factor authentication (TOTP), with single-use backup codes. Secrets are encrypted at rest.
• Sessions are signed, expiring cookies. Deleting a user or organization invalidates access immediately.
• Password reset and email verification tokens are stored hashed and expire on a short window.
• Suppliers never get an account in your organization. They access a scoped, expiring link that only shows their own orders, quotes and agreements.

Accountability

• Every create, update, approval and rejection is written to an append-only audit log recording who or what did it, and when. The one exception: erasing a supplier contact also removes their name, email and phone from past entries.
• The audit log distinguishes actions taken by a person from actions taken by the agent.
• Every agent review is retained in full: what it examined, what it concluded, and what it proposed. Visible in the app, not just in server logs. Erasing a supplier contact removes their details from past reviews too.
• The audit log exports to CSV at any time, and in full as part of the organization's data export.

The marketplace, and what other organizations can see

Discovery is the only feature that crosses between organizations, so it is worth being precise about what does and doesn't cross with it.

• Listing yourself is off by default. Nothing about your organization is discoverable until an admin switches on a seller profile and publishes a listing.
• Buyers see a published listing's public details and your trading name. They never see your products, costs, stock, customers, other listings, billing, or how you have configured your own automation.
• The minimum price you'll accept is never shown to anyone. It seeds your agent's negotiating position and stays on your side of the barrier.
• In a negotiation between two organizations, each side sees the offers made and nothing behind them — not the other's limits, not the other's reasoning. Both can read the full offer history afterwards.
• A trading name is self-declared until someone verifies it. Unverified sellers are labelled as such wherever they appear, rank below verified ones, and changing your trading name clears any verification you had.
• An organization you meet through the marketplace is added to your suppliers excluded from auto-approval. A counterparty you have never traded with cannot reach unattended execution until you decide otherwise.

Your data

• Data is isolated per organization; every query is scoped to your organization at the data-access layer. The single exception is the marketplace, described above, where the crossing points are concentrated in one module so they can be reviewed as a unit.
• Everything you put in comes back out: an admin can download all of the organization's data as one JSON file, leaving out only passwords, keys and other credentials. Products, suppliers, inventory, purchase orders and the audit log also export to CSV from their own pages.
• Deleting your organization permanently removes its data from our database, cancels any active subscription, and asks our call provider to delete the recordings and transcripts of its calls. Copies held by the other providers we use are described in the privacy policy.
• Card details are handled by Stripe and never touch our servers.
• Data is stored in encrypted Postgres, and all traffic is served over TLS.