Identity before company access
A company workspace requires a verified identity and active membership. An email-domain match can help establish eligibility, but it does not replace membership authorization.
SECURITY & ACCESS
Security starts with clear boundaries.
The current product separates guest work, authenticated workspaces, organization membership, imports, and intentional sharing.
Authorization at the data layer
Tenant-owned records carry an organization identifier. Database row-level security checks active membership instead of trusting a tenant identifier supplied by the browser.
Sharing stays intentional
Chart creators and active editors, administrators, or owners can create revocable, read-only share links. A shared view does not grant editing rights or organization membership.
CURRENT STATUS
Implemented controls are described as implemented.
Vibe My Org does not claim a certification that has not been established. Enterprise single sign-on, directory synchronization, and a Microsoft Teams package remain planned capabilities rather than live controls.
External AI can remain disabled while recognized spreadsheets and eligible screenshots are processed locally into reviewable drafts. Other AI-assisted source paths remain unavailable when that workspace policy is off.
START WITH A DRAFT YOU CONTROL