Sirca gives every employee an AI assistant that works with company knowledge. This is how it stays within your permissions, under your rules and on the record.
Access follows your permissions
- People only get answers from sources they can already open. Access is checked when information is retrieved and again before a result is shown.
- If someone loses access to a source, results and saved context that relied on it stop being available to them.
- Every answer drawn from company knowledge links back to the source it came from, with the exact quote.
People stay in control of what is sent
- Assistants cannot send a message or change anything in a connected tool without approval from the person they work for.
- Approval covers the exact content shown. If the content or the account's permissions change, the approval no longer applies. Approvals expire after 24 hours.
- Each connection only has the access its owner chose, and sending is limited to the recipients and resources they listed.
- A send that may already have happened is never retried automatically.
Your organisation sets the rules
- Administrators can allow an action, require a second approval, or block it, for everyone or for a team.
- A second approval can never come from the person whose assistant proposed the action.
- Rules can treat recipients outside your domains, and Slack channels shared with other companies, differently.
- Budgets can be set for the workspace, for teams and for individuals.
A record you can rely on
- Actions that leave your organisation are recorded with the exact content, who approved them and the outcome.
- The record is separate from personal workspaces, so an employee reset does not remove it. Administrators set how long it is kept, 365 days by default, and can export it as CSV or JSON.
- Conversations, results and personal memories are private to the employee and are not part of this record.
AI providers and your data
- You choose the provider. A workspace can use its own provider key and approved models, or Sirca-managed usage.
- Sirca-managed routing requests zero data retention and denies provider data collection by default.
- Content from sources, emails and calendars is treated as data, never as instructions. Assistants act only on what the employee asked.
- Assistants never choose where a request goes. Every external call goes to a fixed provider address.
Data protection
- Connected account credentials are encrypted with AES-256-GCM and bound to their organisation, owner and connection.
- Inactive conversations are deleted after 90 days by default.
- Employees can export their personal workspace or reset it at any time.
- We do not sell personal data or use customer source content for third-party advertising.