Security and data
Where your data goes, and where it does not.
One gateway handles every model call. Brands and organizations are kept apart in code, not by a prompt. Runs land in a ledger with their exact cost. What we haven’t built yet is listed at the bottom.
One gatewayevery model call, no exceptions
Scope in codeorganization, brand, user
Five rolesfrom super admin to viewer
One ledgerwho, what, when, which model, cost
Checked against the codeSeptember 19, 2026
One gateway. No exceptions.
A module that needs a model sends its call to one gateway, which forwards it to the provider your admin picked for that module.
Eight providers carry a text prompt today: Anthropic, OpenAI, DeepSeek, Qwen, xAI, Zhipu, Kimi and Mistral. The drawing shows a sample of them; check the full list against your approved-vendor list, and the changelog records when it changes. Image and video prompts also reach Google, Black Forest Labs, ByteDance, Meta, Kling and MiniMax.
Click a module to send a call
Pick a provider on the right, then click a module.
No code path talks to a provider directly. One key, held on the server, never shipped to a browser.
Your choice
You decide which models each feature may use.
Your admin sets the models on offer and the default, feature by feature, and the person running it picks one. A model we stop supporting falls back to the default.
No training
Your prompts aren’t used to train anything.
Calls go to the providers on their API terms, which exclude training on API traffic. We keep the ledger line, not the transcript.
Walls enforced in code.
There’s no prompt asking the model to behave. A filter runs before any query does.
Your company is an organization holding brands. Pick a brand on the right and read what every query for it carries.
Brand A context and documentsbrand
Brand A drafts and findingsbrand
Brand B context and documentsbrand
Brand B drafts and findingsbrand
People, settings, ledger, walletorganization
Brand C context and documentsbrand
Brand C drafts and findingsbrand
People, settings, ledger, walletorganization
every query carries
No line between the two. Not a thin one.
What the wall stops
A brand can’t read another brand: the filter is applied before the model sees a result. An organization can’t see another organization either, and the database is reached only from our server, with a key that never leaves it. Pause an organization and every sign-in is refused. There’s no half-paused state.
Five roles. One gate.
Every user carries a role, a list of what they can do, not a pricing tier. An admin can grade one person’s rights up or down over their role, and never past what the organization switched on. A user on one brand’s Marketing sees nothing of another brand’s Sales. The detail is on the architecture and on Larger teams.
Under the roles sits a single gate that makes four checks on the server, in the order below. Fail one and the request is refused.
ViewerReads on their own credentials and their own budget. Can’t change anything. The role for a board member or a client.
EditorDrafts and runs the work inside the brands they’re granted. Can’t publish and can’t change settings.
Brand managerRuns one or several brands. Approves, publishes, and shapes the context of the brands they own.
AdminRuns the organization: people, brands, model choice, budgets, the wallet. Sees the ledger for the whole organization.
Super adminBearingBridge staff who operate the platform across organizations. Raw model cost and the interface dictionaries are visible at this level only.
A valid session, checked on the server before anything runssession
The organization has switched the module onmodule
The user has been granted it, and a viewer is refused anything that writesgrant
The brand on the request is one the user holdsbrand
If the database can’t be reached while a permission is being resolved, the answer is no. It never fails open.
If you’re skimming for the assistant, the next section is the one.
The assistant reads. It writes only where you let it.
Ask Intelligence answers from a fixed set of read-only tools, limited to the brands you picked for the conversation. The web comes in only when you switch search on. The one thing it can write is an email left in your own Drafts, if you connected Gmail, and sending stays off until you turn it on.
The loop is bounded: a fixed number of steps, a fixed size for what each tool may hand back. When the base doesn’t contain an answer, the assistant says so rather than inventing one.
Steps, capped at eight
What each tool may hand back
One box. The one you labelled.
Curated, not crawled
The data the assistant reads is yours, bounded by the brands you pick, and the web only when you ask for it. A guideline can shape the tone of an answer, not where it comes from.
Every run, on the record.
Every model call is written to the ledger before its cost is charged to your wallet: who asked, in which brand, which model answered, the tokens, the cost, the time. An admin sees the whole ledger; users see their own lines.
Three caps are checked before a call goes out: the prepaid balance, the user’s daily cap, and the organization’s monthly cap. The full picture is on Cost and control.
Prepaid balance$126.40 / $250.00
The wallet. Funded in dollars, never expires.
User daily cap$1.62 / $2.00
Set per person by the admin.
Organization monthly cap$318.90 / $600.00
Set once for the company.
| Who | Organization | Brand | Action | Model | Tokens in | Tokens out | Cost | When |
|---|---|---|---|---|---|---|---|---|
| L. Bernard | Your org | Brand A | Marketing · Draft | Anthropic | 1,204 | 412 | $0.0098 | 09:12:04 |
| S. Ito | Your org | Brand A | Sales · Brief | OpenAI | 2,310 | 655 | $0.0167 | 09:14:51 |
| R. Haddad | Your org | Brand B | Service Desk · Answer | Mistral | 640 | 188 | $0.0047 | 09:15:20 |
| M. Okafor | Your org | Brand B | Business Intelligence · Summary | DeepSeek | 3,980 | 902 | $0.0255 | 09:19:37 |
Click Run a call to add a line.
A ledger a controller would recognize.
Agents are on the record too
Every agent run is stored with its status, its result, and any error, and every finding is attributed to the agent that produced it.
Sign-in, money, files, and the public assistant.
Signing in
code by email · http-only cookie · single-use reset
An organization can ask for a second step: a six-digit code sent by email, valid ten minutes, on by default for new organizations. A browser can be trusted for 30 days, and trust can be withdrawn in Settings. The sign-in cookie is HTTP-only, same-site, secure, and expires after a day. A password or email change asks for the current password first. The reset link is single-use, rate-limited, and the response never reveals whether an address exists.
Money
stripe · signed webhook · recorded once
Payments run on Stripe. Your balance only ever increases from a signed webhook we verify, and every event is recorded once, so a retry can’t add the money twice.
Files
type and size checked · signed links
Uploads are checked for type and size. Logos and avatars are public; everything else is private, served through short-lived signed links.
Service desks
curated only · hashed visitor · daily cap
Each desk answers only from what you curated and says so when it can’t. Visitors are identified by a salted hash of their IP address, and a daily cost cap per desk switches it off before the bill becomes a problem.
Sign-in and reset emails come from bearingbridge.com. We send nothing to your users that you didn’t trigger.
The built part ends here. What follows isn’t built.
What is not done yet.
An evaluator who finds one of these out on their own will trust nothing else on this page.
Here they are, in contract language. When one changes, this board changes the same day and the changelog records it. Send a security questionnaire through the contact page; a person answers it, line by line.
Last checked against the code September 19, 2026
No SOC 2 and no ISO 27001 today. The audit starts when customers need the report, and then this line changes.
Data lives in a single region, and a choice of region isn’t offered yet. Ask, and we’ll name the region in the contract.
The second step is a code sent by email. No authenticator app and no text message today.
No SAML and no enterprise identity provider. If your policy requires it, say so before you buy, not after.
The ledger records what the models did. A record of who took what data out of the product isn’t built, and the catalog says the same.
Six things you can check.
Bring this page to the person who has to sign.
Start with one module on one brand. Or ask the question this page didn’t answer, and get it in writing.
No subscription. No seat fee. Money in a wallet, spent on tokens, storage and data, and your balance never expires.