Data
Every control, and how it’s checked.
01 · The record
How data flows.
Your boundary
Read · draft · approve · record
Roya reads the systems you connect, drafts an action from what it found, holds it until one of your people passes it, and records what happened.
Read-only connectors
scope: read
- ERPGL-4471
- CRMACC-3391
- BillingINV-5514
- Contract storeCT-2208
- Data warehouseQ4 forecast
Roya
Your models · your cloud
- CustomerCRMERP
- TransactionBillingERP
- SupplierContract storeERP
Keys · custody: yours
Endpoints · decided in the engagement
Held at the boundary
Drafted responseThe audit row
Nothing to record yet
- Action
- Note to the contract owner
- Passed by
- The role your policy names
- Records read
- Five, each named
- Written
- Append-only. No role holds update or delete.
02 · The controls
The guardrails enterprises need.
What it protects
The control
What it means in practice
How it is verified
Your data is never used to train a model.
Only two server routes can reach a model at all. Those calls carry no fine-tuning path and log nothing of what was sent — and because the model runs on your key, retention is governed by your own agreement with that provider.
An automated test runs on every code change. If it fails, the change cannot be released.
No business data reaches product analytics.
Events are screened against an allowlist before they are sent. Unknown fields are dropped, and values are screened as well as field names.
Same as above
Connection credentials are encrypted before storage.
Each credential is sealed before it is written. The stored value contains no part of it, the same credential encrypts differently every time, and a single altered byte fails to decrypt.
Same as above
03 · The engagement
What you decide at onboarding.
Your deployment
Which model runs, and where
Roya runs on model keys you bring, inside your own environment.
The provider, the endpoint, and the region it runs in
Write-back
A deployment can enable approved actions: Roya actions them, or hands context downstream to the system that does.
Which systems it may write to, and which actions
The record, in your own tooling
What was read, drafted and approved can be delivered to your own logging or SIEM.
Whether it is on, and where it goes
Your business logic
Your industry lives in configuration rather than in engine code, and Roya maintains it for you.
Which rules and workflows the configuration covers