AI Trust Center
How the Planoda agent is governed: your data never trains foundation models, destructive actions go through propose/approve, every agent action is recorded in the immutable audit log, and agents are clamped to allowed tools inside the row-level tenant boundary. Multi-LLM via an AI gateway, with workspace budget gating and prompt-injection hardening.
This page covers how the AI agent is governed. For the general security and compliance posture — encryption, SSO, SOC 2 status, data residency — see the trust center. Planoda is pre-launch; anything not yet generally available is labelled as such.
In short
AI governance
Six commitments that govern how the agent reads, acts, and spends inside your workspace.
No-train guarantee
We send your prompts and context to model providers to generate a response — and nothing else. Your workspace content is never used to train, fine-tune, or improve any foundation model, ours or a provider's.
Human-in-the-loop
The agent can read and draft freely, but anything destructive — delete, bulk archive, bulk update — stops and asks. The proposal surfaces exactly what will change so a human approves before it runs.
Audit trail
There is no separate, lossy AI activity feed. Agent reads, writes, proposals, and approvals are written to the same immutable, hash-chained audit log as every other privileged action in your workspace.
Permissions & scoping
An agent can only call the tools its skill explicitly allows, and every query it makes runs inside the same Postgres row-level security boundary as the rest of your workspace. It cannot reach another tenant's rows — the database enforces it.
Data residency & retention
Agent context is your existing workspace data — governed by the same residency and retention controls as the rest of Planoda. Transcripts are tenant-scoped; deleting the underlying workspace data removes it from the agent's reach.
AI cost controls
Every workspace has an AI quota. The agent runs a preflight budget check before each call and records spend after, so a runaway prompt can't quietly burn your bill. Bring your own gateway key to bill providers directly.
Models & prompt handling
Which models we use, how the agent connects, and why the content it reads can't take it over.
We route through an AI gateway rather than wiring one provider in. Claude, GPT, and Gemini sit behind one interface, so we can pick the right model per task tier and fail over without changing the contract your data flows through.
The agent speaks the Model Context Protocol over the same tRPC procedures and RLS boundaries the product itself uses. There is one access surface for people and agents — not a second, less-governed API for AI.
Content the agent reads — issues, comments, transcripts — is handled as untrusted data, scrubbed before it reaches a model, never executed as instructions. Prompt-injection hardening is the default, so a poisoned comment can't hijack a tool call.
Distilled and hand-authored agent skills carry an explicit allowed-tools list that is clamped against the canonical tool registry. An agent can't grant itself a capability that wasn't already in the registry it was built from.
The paperwork
The agent inherits the platform's governance. Here's where the source documents live.
Governance sources
FAQ
The questions every procurement and security review asks about AI — answered plainly.
Talk to us
Bring your AI security questionnaire. The agent runs on the same audited, tenant-isolated foundation as the rest of Planoda — we'll walk you through every control.