Security
We start from a simple idea: an AI employee working in your systems should be held to a higher standard than any human contractor — kept on a tighter leash, watched more closely, and easier to check. Every action follows the rules you set, runs on scoped access you can revoke, and lands in a record that can’t be edited or deleted.
Principles
Praxa never asks for a person’s password. It connects to each tool through that tool’s own scoped authorization, one token per connector — and every token it holds is encrypted at rest and revocable per workspace at any time in one click. Elevated or risky access is granted per approved action and expires on its own.
Bring your own AI key and inference lands on your own cloud bill, never resold — or choose managed compute and there’s no key for you to store at all. Any key you provide is encrypted at rest and only used while your employee is actively doing a piece of work.
Your data is kept completely separate from every other customer’s, and the system blocks any attempt to read across that line. Enterprise gets a dedicated setup where the separation goes all the way down to the storage itself.
Every action is one entry: what it saw, what it decided and why, the options it weighed, and what it did. The log is append-only — no edit or delete path — and approvals and permission grants are additionally sealed in a tamper-evident hash chain, so a single altered entry is obvious.
For every task, you decide: do it on its own, check with you first, or never. Anything a customer sees or that spends money waits for your OK; the things you mark off-limits it simply can’t do. Those limits are enforced in code — the tool allowlist and memory boundaries are checked before any action runs, not left to a prompt the model could be talked out of.
When an employee reaches a step that needs approval, the in-flight task pauses right there. Approve it, and the same task resumes exactly where it left off and runs the byte-for-byte action you approved — nothing more. For money and other high-stakes moves you can require two people, and grants are short-lived, not standing keys.
Untrusted content an employee ingests — a customer message, an email, a web page — is screened for prompt-injection and tracked so it can’t silently escalate into an action you didn’t sanction. Effects run exactly once, so a retry never double-sends or double-charges.
Every employee has a quality bar you can see. If its work starts slipping below that bar, it pauses itself and tells you — by Slack, email, or pager — and a person has to review and restart it. And one click freezes everything, instantly, no matter what it’s in the middle of.
The record
The record is the promise. Every single action is one entry that captures everything the employee knew at the time — written to an append-only log with no edit or delete path.
{
"auditEventId": "ae_01j...",
"agentId": "ag_01j...",
"runId": "rn_01j...",
"trigger": "helpdesk.ticket.created",
"input": { "ticketId": 1284, "subject": "..." },
"reasoning": [
"Customer was charged twice for order #4471 — refund warranted.",
"Refund of $49 is above the auto-approve limit.",
"Account is in good standing; no prior refund this quarter."
],
"alternatives": [
{ "action": "auto_refund", "score": 0.42 },
{ "action": "request_approval","score": 0.83 },
{ "action": "escalate_human", "score": 0.71 }
],
"confidence": 0.83,
"output": { "verdict": "request_approval", "draft": "..." },
"tools_used": ["helpdesk.read.ticket","helpdesk.draft.reply"],
"duration_ms": 4218,
"occurred_at": "2026-05-26T14:18:09.182Z",
"prevHash": "9f2c…",
"rowHash": "4ad1…"
}Where your data lives
Compliance
For your security team
We turn them around in days, not weeks. Send us your standard questionnaire and an NDA — we’ve already done the homework and have the answers ready.