Explicit authorization
Bind approvals to exact actions, accounts, audiences, budgets, and expiry. Changed scope needs renewed approval.
Trust by designUseful AI.
Useful AI.
Bounded authority.
The security principles guiding our implementation. This page is not a claim of certified production security.
Separated business data
Design for tenant isolation, least-privilege access, protected credentials, and access logging.
Traceable activity
Keep a record of research, plan versions, approvals, connector actions, and experiment results.
Untrusted content stays untrusted
Treat websites and retrieved documents as data, never as permission to change instructions or execute actions.
Budget and stop controls
Enforce usage caps, bounded retries, spend limits, and a way to stop connected execution.
Data minimization
Ask only for necessary information and define retention, deletion, and vendor terms before launch.
No SOC 2, ISO certification, penetration-test result, data-residency guarantee, or production SLA is claimed. Connected actions are not available in this preview.
Security reporting: email hello@expandwith.me. Do not send passwords, API keys, or unnecessary sensitive information.