Security & data protection

Boatwork Assist is built for businesses that need an AI agent to work inside real operational systems without turning that access into an open-ended privilege. This page is written for IT, security, legal, and enterprise buyers who need to understand how data is isolated, where it is stored, who can access it, and what compliance work is complete or in progress.

Enterprise review summary

Tenant boundary

Organizations are the primary tenant boundary. Dashboard access is authorized through organization membership and role permissions, and every agent belongs to exactly one organization.

Agent runtime boundary

Each agent runs in its own dedicated runtime with its own workspace and agent credential. Agents authenticate to Boatwork APIs with agent-specific bearer tokens.

Storage

Boatwork Assist stores application data in managed cloud services on Google Cloud Platform in the United States. Agent workspaces, conversation history, email caches, and audit events are scoped by organization and agent.

Credentials

OAuth refresh tokens, client secrets, API keys, LiteLLM keys, and SSH credentials are stored as AES-256-GCM authenticated ciphertext before being written to the database.

Access control

Users authenticate through the dashboard and are authorized by role-based permissions: Owner, Admin, Member, and Viewer. Platform admin surfaces are separately gated to internal Boatwork accounts.

AI providers

Message content is sent to third-party model providers only to generate responses. We select providers that do not use customer data for model training by default.

Account connections stay under your control

To work with email, calendar, documents, and business systems, an agent connects through the provider authorization flow appropriate for your environment. For Google Workspace and Microsoft 365, that may include an administrator-approved organization connector or per-mailbox OAuth, depending on how your tenant is configured. In either case, Boatwork binds runtime access to the organization, agent, and mailbox or integration that was configured.

You can disconnect an account or remove an integration in Boatwork, and you can also revoke access directly from Google, Microsoft, or the relevant provider. Revocation clears stored credentials where applicable and restarts affected agents so cached access is dropped.

Least privilege and capability ceilings

Boatwork requests the permissions needed for the work an agent is expected to perform, such as reading and sending mail, managing calendar events, or using an approved business integration. Organization-level security policy then caps what agents can do at runtime: which tool categories are available, whether command execution is allowed, whether approval is required, and how filesystem access is constrained. An individual agent can be more restrictive than the organization policy, but not more permissive.

Credential encryption

Long-lived secrets are encrypted before storage using AES-256-GCM authenticated encryption. This includes OAuth client secrets, stored refresh tokens, integration API keys, LiteLLM keys, and Mac SSH credentials. General workspace files, conversation logs, and business context are protected by tenant scoping, role-based access controls, managed cloud storage controls, and TLS in transit; we do not currently claim blanket application-level field encryption for every customer data object.

Short-lived operational tokens

Long-lived refresh tokens stay encrypted server-side. When an agent needs to act, it requests a short-lived access token from a Boatwork API endpoint authenticated by that agent’s own credential. The endpoint validates that the requested mailbox or integration is configured for that agent before minting the token.

Isolation between organizations

Each organization’s credentials, configuration, workspace data, and agent context are isolated. Dashboard routes authorize against the user’s organization membership, while agent-control routes authorize with the agent’s own token and resolve storage paths under that agent’s organization. See How knowledge sharing works for how knowledge is scoped within and between organizations.

Audit logging and observability

Administrative and configuration changes such as connecting providers, changing member roles, toggling agent flags, changing routines, and disconnecting credentials are recorded as audit events. Agent observability events are agent- and organization-scoped, and ingestion rejects sensitive-class events and email transcript payloads by design.

Retention and deletion

Conversation and agent logs are retained for 12 months by default as described in our Privacy Policy Supplement. Email cache retention is configurable by organization and agent, with system defaults of 365 days for needs-attention mail, 180 days for awareness-only mail, and 30 days for commercial-spam cache entries. Live inbox cache and sent-mail cache are handled separately. You can request deletion or offboarding support at hello@boatwork.co.

Third-party AI model providers

To generate responses, message content is transmitted to third-party AI model providers (which may include Anthropic, OpenAI, and others) solely to produce the reply. We select providers that do not use customer data for model training by default. Provider data handling terms vary by model provider and deployment path. See AI & data handling for the commercial terms, retention, and our Zero Data Retention roadmap.

SOC 2 readiness status

A SOC 2 report requires more than secure product architecture: it requires formal policies, operating procedures, evidence collection, access reviews, vendor management, incident response records, change management evidence, and an independent audit period. Boatwork has product controls that map to those areas, but we do not yet have a completed SOC 2 Type I or Type II report.

The main readiness work still ahead is formalizing and evidencing the control program: periodic access reviews, key-rotation procedures, vendor and subprocessor register, incident-response and business continuity testing, retention/deletion evidence across all data classes, vulnerability management records, and a control owner/evidence calendar.

For IT and security review

If your IT or security team is reviewing Boatwork Assist, these are the areas we expect to document with you:

• OAuth scopes requested: which Google Workspace or Microsoft 365 permissions are needed, what each one enables, and whether a narrower configuration is possible for your use case.
• Authorization model: whether a capability uses per-mailbox OAuth, admin-approved provider authorization, an agent-level token, or a third-party integration credential.
• Data retention: how long conversation logs, agent workspace files, email cache data, and billing records are retained, and what can be configured or deleted on request.
• AI model providers: which providers may process requests, what data is sent to them, and the provider data-handling terms that apply.
• Admin and user roles: how Owners, Admins, Members, and Viewers map to organization, agent, storage, billing, and member management permissions.
• Integration revocation: how to disconnect accounts in Boatwork, revoke OAuth access in Google or Microsoft, rotate API keys, and restart affected agents so cached access is dropped.
• Security roadmap: what is complete today, what is planned for SOC 2 readiness, and what compensating controls are available during evaluation.
• Deletion and offboarding: how to remove users, disconnect integrations, decommission agents, and request deletion of workspace or account data.