Your data is isolated by a lock in the database
We do not rely on a developer remembering to add a filter to every query —
forgetting is a matter of time. Isolation is enforced by the database itself:
a policy on every table that stops a single row from crossing between shops,
and an application account with no power to disable or bypass it.
FORCE ROW LEVEL SECURITY · no BYPASSRLS
A usage ledger we ourselves cannot erase
Every model call is written to a permanent ledger. The application's rights on
that ledger are insert and read only — no update, no delete — enforced in the
database rather than promised by us. A log its owner can erase is not a log.
usage_ledger — INSERT + SELECT only
Your vertical is not a special case buried in code
The difference between a clothing shop, a restaurant and a services office
lives entirely in one row of data: the instructions, the examples, the order
fields, the escalation rules, the word for what you sell. A new vertical is a
new row — not a new release, and not a month of waiting.
industry_packs — a row, not a release
The bot admits what it doesn't know
When the answer isn't in your shop's knowledge, it doesn't invent one. It stops
itself, escalates the conversation to you, and flags it as needing a human.
An invented price or an imagined return policy costs you a customer; a two
minute delay costs you nothing.
action: escalate | unknown