Who can see the data our workflows handle?

Every piece of code a workflow runs, whether the agent wrote it during codification or as part of an integration, executes in a fresh sandbox that starts from an empty environment and is torn down afterwards whatever happened. It receives the credentials that workflow declared and nothing else. Not our model keys, not our database, not the machine it runs on.

A workflow acts with its owner's access, not a shared god account. Your workflows stay yours inside your own organisation, and one tenant's work never runs in another tenant's sandbox.

Credentials are stored per connection and never appear in what a run records. The scrub happens at the point a run is written, so a key cannot leak into a transcript, a step's inputs or a live stream and sit there.

The record itself is pinned to the exact workflow version that produced it, which is what makes an audit answerable later rather than reconstructed from memory.