DigitGPTSecurity, Privacy & Governance
Workspace Security & GovernanceDigitGPT enforces multi-tenant workspace isolation, role-based access control, server-side credential protection and domain-restricted publishing so your assistants and knowledge assets remain under your organization’s governance.
Multi-tenant isolation and role-based access
Every organization workspace is logically isolated. Authenticated API requests require both a verified Firebase ID token and an active membership record for the target workspace. Supported roles are owner, admin, editor and viewer: modifying assistants or knowledge requires editor permissions or higher, while billing, team invitations and custom avatars require owner or admin privileges.
All infrastructure API keys remain strictly on the server. Browser clients and embedded widgets receive only short-lived, scope-limited session tokens.
Knowledge governance and publication controls
- Scope knowledge groups deliberately: any document attached to a published assistant can be retrieved to answer visitors interacting with that assistant.
- Knowledge group ownership is verified on the server against the active workspace before any retrieval tool is attached.
- Lock published embeds to your authorized production domains in Embed settings to prevent unauthorized third-party embedding.
- Do not upload unredacted personal health records, payment card data or secret credentials into public-facing knowledge groups.