ISOLATION
Every client stays inside its boundary
Resources are scoped by tenant and partner; cross-boundary attempts are tested before flows are closed.
SECURITY & COMPLIANCE
Speed is worthless when it exposes the client's business.
Aymar applies security at the core so partners can sell automation with understandable limits and operating evidence.
Review my caseDefault-deny across resources, tools and actions
PERMISSIONS
It can only do what is allowed
First-party integrations expose curated actions that are disabled by default.
AUDITING
Sensitive decisions leave a trail
Activity, access and actions support incident investigation and operating evidence.
INJECTION
Instructions are inspected too
Configurable content passes controls designed to reduce malicious instructions and context leakage.
AI ACT
AI identifies itself as AI
Each channel must disclose automated interaction and retain a path to human service. Breaching Regulation (EU) 2024/1689 can be fined up to €15 million or 3% of global turnover (art. 99).
GDPR
Privacy from capture to deletion
Minimisation, retention, rights and responsibility mapping are designed in, not added later. Breaching GDPR can be fined up to €20 million or 4% of global turnover (art. 83).
4 LAYERS
Four access layers, always in this order
Existence (the integration is connected), visibility (the agent has the label), audience (internal or also client-facing) and the requester's permissions. No action crosses all four without explicit authorisation.
ENCRYPTION
Every credential, encrypted with its own key
Third-party credentials are encrypted with AES-256 and an independent key per client, stored outside the database.
ROTATION
Keys that rotate, credentials that truly disappear
Encryption keys rotate without interrupting the service; when a client is deactivated, their credentials are cryptographically erased.
NO EXPOSURE
No credential is ever shown in full
After a connection is created, only its identifying hint stays visible — never the full value, not even through the public API or the MCP server.
POST-QUANTUM
TLS 1.3 with hybrid post-quantum key exchange
Encrypted traffic uses a hybrid, classical and post-quantum, key exchange wherever the terminator already supports it.
CONTROL CENTRE
Trust is built one layer at a time.
Toggle each boundary to see why commercial automation needs more than a good prompt.
Aymar
IsolationPermissionsAuditingHuman oversightACTIVE CONTROLS4/4Operation protected by design
Operation protected by designReview my scenario
PLAIN WORDS
Four technical terms, explained plainly.
Merchant of Record (MoR)+
The party that legally sells to the end client: invoices, charges and is accountable for the sale. In your case, that is you.
BYOK+
"Bring Your Own Key": using your own AI provider key instead of Aymar's. It is optional.
MCP+
A standard protocol for connecting an external tool server to an AI agent. Third-party MCPs are opt-in, under your responsibility.
Allowlist+
The list of actions a worker is allowed to run. Anything not on the list stays blocked by default.
Turn compliance into a commercial advantage.
We review the flow, data and integrations before deployment.