Security & ownership
The model can ask. Only code can allow.
Before a restricted tool runs, deterministic Python code in Hubzoid checks the person’s grants, so a persuasive prompt cannot change the answer.
How access is enforced
The AI never decides which tools are allowed.
The model can propose any call. The check reads who is asking and what they were granted, never the conversation, so no prompt or pasted instruction can unlock a tool.
- Checked on every call, before the tool’s code runs
- A refused tool never runs, and refusals show in the Console
- The same check on every surface, including MCP and workflows
update_records()Sign-in and identity
Know who is asking on every surface.
People sign in to web chat, assistants connect over MCP after the person signs in and approves the connection, and scheduled work runs as an ordinary user account.
- Slack, WhatsApp and Telegram reach restricted tools only if you allow it
- Unknown WhatsApp and Telegram numbers never reach the model
- Turn sign-in on before you share a Hub
Access you manage
Access to each agent, and to each tool.
A person needs access to an agent, and each restricted tool needs its own grant. People with Manage access change grants in the Console, and every change is recorded.
- Changes apply on the next call, with no restart
- Delete user removes a person from every agent at once
- Hubzoid’s built-in tools cannot change grants
Where data lives
Self-hosted, on infrastructure you choose.
Chats, grants, activity and run history stay in your deployment. Each model call goes to the provider you choose, under that provider’s terms.
- Tracing and chat channels send data only when you turn them on
- Web search and page fetching can be switched off
- Self-hosting alone does not make a deployment offline
Visibility in the Console
See what ran and what was refused.
The Console lists workflow runs, every access change with who made it, and restricted tool decisions with their outcome. Every restricted call that runs is recorded.
- Filter decisions by person, tool, channel and outcome
- Keep consequential actions restricted so every call is checked
Open source
Read the code that makes the decision.
The access check, the grant store and the decision log are open source, so your team can see exactly how a call is allowed or refused.
- Run it yourself and upgrade when you are ready
- Security fixes ship in new releases
Working with us
Build with us, or tell us about an issue.
How we treat your systems during an engagement, and how to report a vulnerability privately.
Review it yourself
Read the code behind the access checks.
The team controls are open source. Review them on GitHub, or talk to us about a build that meets your security requirements.