The boring questions, answered properly

Every table that belongs to a workspace carries its id, and every query that reads one is checked by a test that counts the ones that do not. That number has only ever been allowed to fall.

Which tables may be pooled across workspaces at all is a list written down by name, and two of them — WhatsApp threads and inbound messages — never can be.

Where a figure genuinely comes from more than one business, like a price benchmark, it is a number and never a name, and your workspace has to opt in before it either contributes to or draws from it. Agreeing one way without the other would not be fair.

Both are empty when you start, and empty means it moves no money without being asked.

A per-action limit on its own bounds nothing — a hundred payments just under it pass one at a time — which is why the daily figure exists.

The five built-in roles fit most businesses, and you can write your own — a bookkeeper who touches money but not customers, for instance. You can only grant a role something you hold yourself.

Separately from that: a record rule says which rows a role reaches, and a field rule says which columns they see of the rows they do reach. Twenty-four fields are hidden from everybody but the owner by default, including what things cost and what colleagues are paid.

Several countries restrict moving personal information across their borders — South Africa's POPIA section 72 is one, and some government data must stay in-country by directive.

The setting is in the product and it will not accept a pin until the deployment it runs on can actually answer where it runs. That is deliberate: a residency promise nobody can verify is worse than no promise, because somebody will rely on it.

A login is rate-limited per address and per source. Without the clearing rule, somebody who mistypes their password four times is one slip from being locked out of their own business.

The message never says which part was wrong — not whether the address exists, not whether it was the password or the code. Each of those is a question an attacker can ask repeatedly. Every attempt, successful or not, is on your account's own security page.

A screen left alone signs itself out: after thirty minutes with no key, tap or mouse, a minute's warning, then out — and a laptop opened the next morning is signed out before anybody sees a page. The owner sets the time, from fifteen minutes to a working day, or switches it off; our own console is fifteen minutes and cannot be changed.

A password you give us for a maker's account is sealed with your workspace's own key and again with the platform's, bound to that one connection. Where the maker needs only a fingerprint of it, only the fingerprint is kept. Four places in the code may open it, and a test fails if a fifth tries.

Every device starts read only. You choose, per device, whether the assistant may suggest changes for you to approve or act within the hours and limits you set; a device on your do-not-switch list is never switched from here. Every change, refused ones included, goes on the audit trail, which is chained entry to entry so that none can be altered or removed without it showing.

Closing types the business name, waits a week, and offers you a copy of the records before anything is removed. That retention obligation outlives us either way, so deleting them on request would not be a kindness.

We do not run a one-click export wizard, and we say that plainly rather than implying otherwise. Every table that belongs to you is covered by the copy you are offered, held open by a test that fails when a new table is added without one.