02
Workspaces, identity, access
Every user belongs to one or more workspaces, and every asset, invoice, meeting, and chat is scoped by workspace. Divisions and teams live inside. You join through invite codes, email invites, domain auto-join rules, or self-service requests with approval, and workspaces can send each other cross-workspace requests for data or action — useful for group companies and client work. Roles are enforced through a security-definer function that avoids RLS recursion, with global roles, workspace-level roles, fine-grained permissions, and data scopes on top. Auth is email, password, and Google, gated by a managed authenticated route.
03
Assets, from first serial to last audit
Laptops, monitors, phones, tools — anything with a serial number. Each asset holds one person at a time, and the full possession chain is preserved in history. Straight-line depreciation with residual value auto-posts to the general ledger. Maintenance records track servicing and the next service date. Retired items are archived, never deleted, so compliance trails survive. Every asset gets an unguessable public share token, so an auditor or repair shop can view read-only details without an account. Bulk provisioning imports hundreds of assets from a CSV in one run.
04
Books — a full ledger, wired in
A lightweight double-entry ledger wired into everything else. Chart of accounts, accounting periods, company profile with VAT and base currency. Accounts receivable — invoices, recurring invoices, credit notes, and public pay-links customers can settle without an account. Accounts payable — bills, vendors, purchase orders. Expenses with receipts. Payments with allocations against invoices and bills, plus Paddle for online payment. Bank reconciliation with rules for auto-categorisation. Full general ledger with journal entries, recurring journals, multi-currency, and FX rates. Payroll with employees, compensation, pay periods, and payslips — auto-posted. And a signed inbound webhook receiver so anything can push transactions in.
05
The AI copilot, not a chatbot
The AI is not a bolt-on chatbot. It reads live workspace data and can propose actions across every module. Chat AI streams with tool calls into a spatial canvas where long-form docs, tables, and plans become first-class artifacts you can link, group, and iterate on. Long-running agents perform scheduled work — reconciling the bank feed nightly, flagging anomalies, catching up an absentee. An Executive Council convenes specialist agents to debate a decision and produce a synthesised recommendation. A dedicated thinking mode shows the multi-step reasoning path for hard questions. AI tasks run autonomously with per-step audit trails; safe steps execute, mutating ones surface as pending approvals. Per-user memory keeps context across sessions. Every request is metered against per-workspace budgets with top-ups and a full usage ledger.
06
Meetings and chat, one fabric
Schedule a meeting from any chat, invite the conversation members, record with consented per-participant permissions. Live captions stream in real time. When the meeting ends, AI produces the summary, decisions, and action items from the transcript. Absentees open a private catch-me-up thread that answers their questions grounded on what actually happened. Video calls launch instantly from any conversation. Chat itself covers one-to-one and group threads with reactions, replies, forwards, mentions, images, voice notes, files, and a first-class custom sticker system. Right-click any message to spawn a task. Mention @AI to pull the copilot into the thread with full context.
Verify a real human without a third-party vendor. Eight layered signals — document capture with OCR, selfie liveness, device fingerprint, email and phone reputation, sanctions and PEP checks, address plausibility, behavioural signals, and manual review — resolve in a live timeline with pass, warn, and fail states. A composite trust score is used across the app, so a large payment or role escalation can gate on it. For companies, entity verification pulls live from business registries, WHOIS and RDAP, DNS, and the company's own domain to confirm the entity matches the claim. Where an auto-pull misses something, the UI surfaces a gap-fill card asking for the specific missing evidence.
08
The rest of the surface
Custom dashboards with widgets fed from tables, SQL, external HTTP sources with an SSRF guard, or natural-language widgets that generate their own queries. A workspace knowledge base the AI retrieves from during chat, so answers stay grounded in company SOPs. Transactional email with its own queue, suppression list, unsubscribe tokens, and custom domain support. Standard integrations with per-integration field mappings and sync runs, HMAC-verified inbound webhooks, OAuth flows with signed time-limited state tokens, and a full audit log of every meaningful change. Row-level security on every public table, workspace scoping everywhere, and prompt-injection labelling on any web content fed to the agents. Marketing pages, shareable asset links, customer pay-links, and workspace join links are the only public surfaces — everything else lives behind the gate.