Trust · one-pager

Security & data handling

For customer security reviews of TC Protect™ Check Write and related TC360™ work. Honest posture: metadata-first, called gate, not SOC 2 certified yet.

What TekCapitol™ sees (Protect Live default)

Write Intent metadata the orchestrator emits (object ids, intended field changes, authority source, freshness stamps, agent / workflow / run ids).
Gate decisions: allow / block / pause, reasons, auditId.
Trace metadata: tool names, timestamps, policy tags, operator pause state.

What TekCapitol™ does not do by default

Does not query or crawl Salesforce, SAP, Snowflake, or your databases.
Does not MITM your SoR APIs.
Does not require raw prompts or full record payloads in SaaS Trace.
Does not claim SOC 2 (or equivalent) certification today.

Minimization

Send only what policy needs: identifiers, intended changes, independent authority values, freshness signals. Prefer hashes or stamps over bulk field dumps. Contracted exceptions (deeper payloads, VPC retention) are explicit on the order.

Four access models (services / Diagnose)

For assessment and guided work, your security team chooses:

Metadata-only — schemas, policies, configs; lowest friction.
VDI / customer environment — work inside your estate.
Customer laptop / supervised session — paired access.
Scoped read-only credentials — least privilege, logged.

NDA and DPA before day one when engagement requires it.

Hosting

SaaS Launch — TekCapitol-hosted Protect API + dashboard (from $750/month per workflow).
VPC / private deploy — quoted when data residency or network isolation requires it.

Control model honesty

Check Write is a called gate. Production paths must invoke check_write / guardedWrite. Skipping the call means the write is not under Protect. v0 does not include cannot-bypass middleware.

Related legal

Salesforce Write Gate → Write Intent schema Check Write design Security questionnaire

Also in Docs

Write Intent schema · what metadata the orchestrator emits
Salesforce Write Gate · product brief and high-assurance mode
Check Write design v0 · decision API and audit log