Shop / Trust
Trust
Trust, control, and a closed desk.
Your company data belongs to your workspace. Guests meet only what you publish. Internal coworkers never walk onto the Mini App.
01
Audience
Guest, staff, or owner — one profile per request.
02
Strip
Internal fields leave EXTERNAL before any model call.
03
Never-do
Discount, refund, hire, tax — blocked.
04
Budget
Reserve first. At the ceiling the desk goes to capture.
05
Confirm
Privileged writes wait for a person on the team.
Who sees what
Business. Department. Coworker. Guest.
Click a layer. This is the privacy map the product enforces — not a slide.
Workspace
Business
Can see
- · Brand, locale, published facts
- · Entitlement and credit use
- · Owner cockpit: pause, takeover, stop
Never
- · Another tenant’s workspace
- · Guest SESSION as a staff file
In product
A gate before every act
A coworker does not jump from a message to a write. The trust gate checks audience, strips internal fields, applies never-do, reserves budget, then asks for confirm on privileged work.
- Guest and staff desks stay separate on dual roles.
- Internal-only roles never appear on the Mini App, sitemap, or QR.
- You can pause, take over, or stop a role from the cockpit.
In product
Business, department, coworker
Visibility is scoped. The business owns the workspace. A department is an optional desk fence. Each coworker is one role with one audience. Guests only meet customer-facing roles.
- Workspace rows are scoped with row-level security.
- HR and finance roles stay internal.
- Each coworker is an AI representative identity, not a natural person.
In product
How data is held
Production traffic uses TLS. Data at rest sits on encrypted disks. Your workspace is not a public table. Guests speak to your brand; Rolera runs the surface.
- Raw conversation text is not used to train a general model.
- Fine-tunes are not eligible on this surface.
- Owner export and delete tools cover the workspace, including derived caches.
In product
The team stays in control
Prices, discounts, hiring, tax, and refunds never belong to a coworker. If credits run out, the desk switches to a capture form so a person on the team can follow up.
- Privileged writes need an explicit confirm.
- Personalize can only narrow tools, never widen them.
- Disclosure stays visible on public desks.
Product behaviour above is in the running surface. English legal copy is APPROVED (ORYGENT-SMARTTEDTECH-REBRAND-ROLERA-2026-03-29). Contact: legal@rolera.net.