Security-first automation
The Security-First AI Automation Platform
Automate business workflows with enterprise-grade security, DPDP compliance, encrypted credential vaults, AI approval guardrails, and complete audit visibility—all from a single platform.
No credit card. The free tier includes 500 workflow runs a month.
Refund requests → finance review
LiveNew Gmail message
Watches the billing@ inbox and fires on messages labelled Refund.
succeededAI extract and classify
Pulls the order ID and refund amount, then scores the request from 0 to 100.
succeededHuman approval
Anything above ₹25,000 stops here until a finance approver signs off.
awaitingPost to Slack
Sends the decision and the reasoning summary to the #finance-ops channel.
running
- T+0.0sTrigger fired: gmail.message.labelled (Refund) · run 8f3c21
- T+0.4sCredential rzp_live_••••4f21 decrypted for 90s, scope payments.read
- T+1.2sAI step returned amount ₹41,500 · risk 68 · above approval threshold
- T+1.3sEscalated to approver group finance-leads · execution paused, no payout sent
- rzp_live_••••4f21
- ya29.a0Af••••7d3c
- xoxb-2••••9a15
1,284
Runs today
3
Awaiting approval
1.9s
p95 run time
- Built for India data residency
- Designed to support DPDP obligations
- Security-first architecture
- Zero-trust design
- End-to-end encryption
- AI approval guardrails
Every label above is an architectural property you can test in a sandbox tenant: where data is stored, how it is encrypted, and which actions stop for a human. None is a certification — we hold no SOC 2, ISO 27001, or STQC attestation, and your reviewer receives an architecture document and a sandbox instead of a badge.
The hidden risk
Automation platforms compete on how quickly you can connect an account, so the default path grants the broadest OAuth scope available, stores the token centrally, and lets a model act the moment it produces output. Every shortcut that removes a click also removes a control, and the bill arrives later as an incident nobody can reconstruct.
Over-scoped OAuth permissions
A connector that asked for full mailbox read and write access just to send one notification keeps that scope forever. One leaked refresh token, and an attacker reads six years of contracts, salary letters, and password resets, then sends mail as your finance head.
Typical platform
Most tools ship a single connect-your-account button wired to the widest scope the vendor allows, because narrow scopes break shared templates and generate support tickets.
SentryFlow
Each workflow requests only the scopes its steps actually call, listed in plain text before you authorise. Adding a step that needs more triggers a fresh consent, never a silent upgrade.
Shadow AI
A sales manager pastes your pricing sheet into a free chatbot to draft follow-ups. The prompt leaves your tenancy, lands with a vendor you have no contract with, and you find out during a customer's vendor-risk questionnaire.
Typical platform
Automation vendors treat model choice as an implementation detail, hiding which provider processes your prompts and offering no inventory of who inside the company is sending what.
SentryFlow
Every AI step names its model and processing region in the workflow definition, and admins restrict which models a team may call. Prompt and response metadata are recorded per run.
No audit trail
A workflow refunds ₹4.2 lakh across 180 orders overnight. Your board asks who approved the rule change; the platform shows the current version, the last editor, and nothing at all about what the rule said last Tuesday.
Typical platform
Execution history is treated as a debugging convenience: mutable, retained for a couple of weeks on lower plans, and silent about configuration edits and permission grants.
SentryFlow
Every run, edit, approval, and denial is written to an append-only log with actor, resource, and outcome, hash-chained so an altered or deleted entry breaks verification and surfaces.
Data residency concerns
Customer KYC documents pass through a queue in Virginia because that is where your automation vendor's default region sits. A DPDP notice asks where personal data is processed, and the honest answer is that you are checking with support.
Typical platform
Region is a signup-time default most teams never revisit, queues and logs frequently sit elsewhere, and the data-flow map you need to answer a notice does not exist.
SentryFlow
Workspaces are pinned to the ap-south-1 Mumbai region for primary storage, queues, and audit logs. Any step that would call an endpoint outside your chosen region is blocked at design time.
Uncontrolled AI actions
A model misreads a sarcastic support email as a cancellation request, and the workflow closes the account, revokes 40 licences, and sends a goodbye note, all inside eight seconds, with no human between the inference and the action.
Typical platform
Model output is piped straight into the next action. Guardrails, where offered, mean a retry on malformed JSON, not a check on whether the decision should execute at all.
SentryFlow
Actions carry risk thresholds. Anything above the limit you set (refunds, deletions, outbound mail to new domains) pauses for a named approver who sees the prompt, the output, and the exact payload.
Compliance gaps
A data principal asks for erasure. The record leaves your CRM but survives in three automation run histories, a webhook retry buffer, and a spreadsheet a workflow wrote last quarter, so the deletion you certified was never true.
Typical platform
Compliance is left to the customer: run payloads are retained opaquely, automation history cannot be searched by data subject, and gathering evidence comes down to screenshots.
SentryFlow
Payload fields can be tagged as personal data, then located and purged across runs by subject identifier. Each request produces a timestamped record designed to support the DPDP obligations you must evidence.
The platform
Ten capabilities that make an automation safe to run before it runs, not after.
Visual Workflow Builder
Versioned canvas with dry-run replay, so a bad edit rolls back instead of paging you.
Drag triggers, actions, AI steps and approval gates onto a directed acyclic canvas. Every save produces an immutable version number, so you can diff v14 against v13 field by field and roll back in one click. Dry-run mode replays the last 50 production payloads against draft logic without calling any external endpoint, and the canvas refuses to publish a workflow with an unresolved credential reference.
Secure Credential Vault
Envelope-encrypted secrets that decrypt only inside a step, never in the browser.
Credentials never sit in your workflow definitions. Each secret gets a unique data key wrapped by a per-tenant AWS KMS customer managed key, and plaintext exists only inside the execution sandbox for the duration of a single step. The UI shows the last four characters and the grant history, never the value. Deleting a connector destroys its data key, making stored ciphertext unreadable.
AI Agent Approval Engine
Agent tool calls are scored and gated by policy before anything executes.
Model output is a proposal, not an instruction. Every tool call an agent requests is scored on blast radius, data sensitivity and rupee value, then matched against your policy: auto-run below 30, queue for a named approver between 30 and 70, hard-block above that. Agents can only call tools you have explicitly allowlisted for that workflow, and a payment step above ₹25,000 always waits for a human.
DPDP Audit Logs
Hash-chained, append-only records of every action, including the ones that were denied.
Every read, write, approval and denial writes one append-only record carrying actor, action, resource, source IP and decision reason. Records are hash-chained, so a tampered or deleted row breaks verification for everything after it. Denied attempts are logged as loudly as successful ones. Retention is configurable from 90 days to seven years, and you can export any window as signed CSV or JSON for a data-protection officer.
India Data Residency
Execution, logs, backups and AI inference stay inside ap-south-1 (Mumbai).
Workspaces are pinned to AWS ap-south-1 (Mumbai) at creation and cannot be silently moved. Execution state, credential ciphertext, logs and backups stay in India, with encrypted snapshots replicated only to ap-south-2 (Hyderabad). Inference for AI steps runs against in-region endpoints, so prompt bodies containing customer data do not leave the country. Any connector that would move data outside India is flagged in the builder before you publish.
Role-Based Access Control
Deny-by-default roles granted per workflow and per connector, mapped from SAML groups.
Five built-in roles (owner, builder, approver, auditor, viewer) start from deny and gain only what you grant, workflow by workflow and connector by connector. An approver can release a queued run without seeing the vault; an auditor can read logs without editing anything. SAML group claims map to roles automatically, and elevated access is time-boxed: grants expire after eight hours and reappear in the audit trail.
Secret Rotation
Credentials rotate on a 90-day clock with an overlap window, so nothing breaks mid-run.
Long-lived API keys are the usual breach path, so every stored credential carries a rotation clock: 90 days by default, 30 for payment connectors. Rotation writes the new key alongside the old one, keeps both valid for a 60-minute overlap so in-flight runs finish, then revokes the previous version at the provider where the API supports it. Anything past its due date raises a workspace warning and blocks new production publishes.
Encryption by Default
TLS 1.3 in transit, AES-256-GCM at rest, with per-field encryption for tagged PII.
There is no unencrypted mode to forget to switch on. Transport is TLS 1.3 with HSTS; storage is AES-256-GCM under a three-level key hierarchy of root KMS key, workspace key and per-record data key. Payload fields you tag as personal data are encrypted individually, so a log line or a support export shows a redacted token instead of a phone number. Backups and queue messages inherit the same keys.
Human Approval Workflows
Runs pause at a gate until a named approver signs off, with reason and escalation.
An approval node parks the run and holds its payload encrypted until a named group decides. Approvers see a diff of exactly what will happen next: the destination, the fields and the amount. Reviewers must type a reason, high-value branches can require two distinct approvers, and requests escalate to a backup group after four hours. Nothing times out into execution: an unanswered request expires as a denial after 24 hours.
Compliance Reporting
Evidence packs for access reviews, consent and erasure requests, exportable on demand.
Reports assemble from the same audit records your runs already write, so evidence is not reconstructed after the fact. Standard packs cover access reviews, consent and erasure requests with fulfilment times, connector scope changes, and every approval decision in the period. Schedule them monthly or generate a window on demand as CSV, JSON or a paginated PDF. The output is designed to support your DPDP obligations and to give an assessor something specific to read.
Workflow builder
Pick a preset, rearrange the steps, then run it. Every run shows where a security checkpoint or a human approval interrupts the flow.
Support inboxes fill faster than agents can read them, so urgent issues sit behind routine ones. This preset reads, categorises, and drafts a grounded reply, leaving a human to approve anything sensitive.
Support inbox triage
Dragging is optional. Tap or focus a node and press Enter to pick it up, then tap or press Enter on a destination node to connect the two. Escape cancels the pending connection.
- Trigger
1. New Gmail thread
Watches a shared support inbox label and fires once per new customer thread, ignoring internal replies and automated bounces.
Not started
- Security checkpoint
2. PII redaction
Strips order numbers, phone numbers, and card fragments into tokens before any message text leaves your tenant for the model.
Not started
- AI step
3. Classify and draft
Assigns a category and severity, then drafts a reply grounded only in the retrieved help-centre articles it cites inline.
Not started
- Human approval
4. Agent approval
Holds the draft for a human support agent whenever severity is high or model confidence falls below your configured threshold.
Not started
- Action
5. Post to Slack
Posts the approved reply, category, and audit-log link to your triage channel, then threads later replies under the same message.
Not started
Text equivalent of the workflow canvas
The ordered list below is a text equivalent of the workflow canvas, naming each step, its role in the pipeline, and what it does when the preset runs.
- Step 1 of 5: New Gmail thread. Role: Trigger. Watches a shared support inbox label and fires once per new customer thread, ignoring internal replies and automated bounces. Current state: Not started.
- Step 2 of 5: PII redaction. Role: Security checkpoint. Strips order numbers, phone numbers, and card fragments into tokens before any message text leaves your tenant for the model. Current state: Not started.
- Step 3 of 5: Classify and draft. Role: AI step. Assigns a category and severity, then drafts a reply grounded only in the retrieved help-centre articles it cites inline. Current state: Not started.
- Step 4 of 5: Agent approval. Role: Human approval. Holds the draft for a human support agent whenever severity is high or model confidence falls below your configured threshold. Current state: Not started.
- Step 5 of 5: Post to Slack. Role: Action. Posts the approved reply, category, and audit-log link to your triage channel, then threads later replies under the same message. Current state: Not started.
Security architecture
SentryFlow treats every workflow run as untrusted input crossing a boundary it must earn: identities are verified per request, secrets never enter the runtime that uses them, and each decision lands in an append-only log. The controls below are architecture and operating practice, described so your team can test them during diligence rather than take them on faith.
Zero Trust Architecture
Network position grants nothing; every internal call is authenticated and authorized per request.
Every service-to-service call carries its own identity. Workloads authenticate with mutual TLS using X.509 certificates issued by a private CA and rotated every 24 hours, so a leaked certificate expires before most attackers finish reconnaissance. A request originating inside the VPC hits the same policy decision point as one arriving from the public internet. Each call presents a signed token whose claims bind caller, tenant, and intended action, with a five-minute lifetime and no refresh path. Policy evaluation is deny-by-default: an endpoint shipped without an explicit allow rule returns 403 instead of silently inheriting broad access. The practical consequence is containment — a compromised connector worker reaches only the tenant scopes already written into its token, and lateral movement produces denied entries in the audit log rather than data.
- Service auth
- mTLS, X.509 from private CA
- Workload cert lifetime
- 24 hours
- Request token TTL
- 5 minutes, no refresh
- Default policy
- Deny; explicit allow required
Zero Trust Architecture
Network position grants nothing; every internal call is authenticated and authorized per request.
Every service-to-service call carries its own identity. Workloads authenticate with mutual TLS using X.509 certificates issued by a private CA and rotated every 24 hours, so a leaked certificate expires before most attackers finish reconnaissance. A request originating inside the VPC hits the same policy decision point as one arriving from the public internet. Each call presents a signed token whose claims bind caller, tenant, and intended action, with a five-minute lifetime and no refresh path. Policy evaluation is deny-by-default: an endpoint shipped without an explicit allow rule returns 403 instead of silently inheriting broad access. The practical consequence is containment — a compromised connector worker reaches only the tenant scopes already written into its token, and lateral movement produces denied entries in the audit log rather than data.
- Service auth
- mTLS, X.509 from private CA
- Workload cert lifetime
- 24 hours
- Request token TTL
- 5 minutes, no refresh
- Default policy
- Deny; explicit allow required
OAuth Scope Minimization
Each connector requests the narrowest scope that runs the workflow, and nothing broader.
Connectors ask for the least permission that makes the workflow function, and the difference is material. A Gmail trigger requests gmail.readonly, never the full mail.google.com scope that would also permit deletion. Sheets access uses drive.file, so SentryFlow sees only the specific spreadsheets a user picks in the file selector rather than an entire Drive. Send actions request gmail.send in isolation, which cannot read the mailbox it writes from. Scopes are declared per connector version and shown on the consent screen before authorization, and widening a scope invalidates the grant and forces fresh consent — an upgrade cannot quietly expand reach. Refresh tokens are stored encrypted, and revoking access in your Google or Meta account terminates the integration at the provider without waiting on us.
- Gmail read
- gmail.readonly (not mail.google.com)
- Sheets access
- drive.file, user-selected files only
- Scope widening
- Invalidates grant, re-consent required
- Grant revocation
- Honoured at provider, no delay
Envelope Encryption
Records are sealed with per-tenant AES-256-GCM data keys that are themselves wrapped by a KMS key.
Payloads, connector responses, and workflow variables are encrypted with 256-bit AES-GCM data keys generated per tenant and per record batch. GCM is chosen for authenticated encryption: a tampered ciphertext fails tag verification and the read errors rather than returning altered data. Plaintext data keys live only in process memory for the duration of a run; the persisted copy is the version wrapped by that tenant's customer master key. Because the hierarchy is row → data key → tenant CMK, revoking one tenant's CMK renders that tenant's ciphertext undecryptable without touching anyone else's, which is what makes deletion provable rather than asserted. Database snapshots and object storage are encrypted at rest underneath this layer, so a stolen backup volume yields wrapped keys and authenticated ciphertext.
- Cipher
- AES-256-GCM, authenticated
- Key hierarchy
- Record → data key → tenant CMK
- Data key scope
- Per tenant, per record batch
- Plaintext key lifetime
- In-memory, single run only
AWS KMS / GCP KMS
Master keys stay in managed HSM-backed key stores in Indian regions and never leave them.
Customer master keys are held in AWS KMS (ap-south-1, Mumbai) or Google Cloud KMS (asia-south1, Mumbai), depending on the deployment you choose. Key material is generated inside the provider's HSM boundary with export disabled, so no operator, support engineer, or database process can obtain the raw bytes — wrap and unwrap happen as API calls, not as key handoffs. Rotation runs automatically on a 90-day schedule; old key versions remain available for decryption so historic runs stay readable without a bulk re-encryption window. Every unwrap request is authorized by an IAM key policy scoped to a single service role and recorded provider-side in CloudTrail or Cloud Audit Logs, which gives you a second evidence trail we cannot edit. Enterprise deployments can point the hierarchy at a CMK in your own account.
- Key stores
- AWS KMS ap-south-1, GCP KMS asia-south1
- CMK rotation
- 90 days, automatic
- Key export
- Disabled; wrap/unwrap via API only
- Provider trail
- CloudTrail / Cloud Audit Logs
Credential Vault
Connector secrets are brokered by a separate service and never reach the workflow runtime.
API keys, refresh tokens, and database passwords live in a hardened secret store, not in workflow definitions or environment variables. The runtime that executes your steps cannot read a secret; it asks a broker service to perform the authenticated call on its behalf, so a template exported from your account, a stack trace, or a debug log contains a reference like cred_7f3a rather than a usable token. Where a provider supports it, credentials are dynamic — database roles are minted per run with a 60-minute lease and revoked afterwards, which shrinks the window a leaked value is worth anything. Values are write-only in the UI: an admin can rotate or delete a credential but cannot display it again after saving. Reads and rotations both emit audit events naming the actor.
- Runtime access
- None; broker performs the call
- Dynamic DB leases
- 60 minutes, auto-revoked
- UI behaviour
- Write-only; no read-back
- Log exposure
- Reference ID, value redacted
Audit Logging
Append-only, hash-chained records of who did what, to which resource, and whether it was allowed.
Authorization decisions, credential operations, workflow edits, approvals, and data exports are written to an append-only store. Each entry includes actor, action, resource, tenant, decision, source IP, and request ID, and carries a SHA-256 digest computed over the previous entry, so removing or editing a record breaks the chain and a verification pass will point at the exact sequence number where it broke. Writers hold insert-only grants; there is no UPDATE or DELETE path exposed to application code or support tooling. Denied attempts are logged as thoroughly as successful ones, which is usually what an investigation actually needs. Retention runs from 90 days on entry plans to seven years on Enterprise, and you can export signed JSONL or CSV, or stream events to your own SIEM over an outbound webhook.
- Integrity
- SHA-256 hash-chained, append-only
- Grants
- Insert-only; no UPDATE or DELETE path
- Retention
- 90 days to 7 years by plan
- Export
- Signed JSONL, CSV, SIEM webhook
AI Approval Gates
Model-proposed actions above a risk threshold pause for a named human before anything executes.
A model can draft a reply, classify a ticket, or propose a refund, but it does not take the irreversible step on its own. Each action type carries a risk score derived from reversibility, blast radius, and whether personal data leaves your tenant; anything at or above your configured threshold halts and queues for review, showing the reviewer the exact outbound payload rather than a summary of it. Approvers are resolved by role, and a request that nobody acts on expires after 24 hours instead of firing by default — the failure mode is a stalled workflow, not an unreviewed send. Every decision records the approver, the model and version, a hash of the prompt and the proposed output, and the latency to approval, so a later dispute can be reconstructed exactly.
- Gate trigger
- Risk score ≥ tenant threshold
- Reviewer sees
- Exact outbound payload, not a summary
- Unactioned request
- Expires after 24 hours, does not send
- Recorded
- Approver, model version, prompt hash
Secure API Gateway
One authenticated ingress: TLS 1.3, signed webhooks, per-tenant quotas, and schema validation.
All external traffic enters through a single ingress that terminates TLS 1.3 with HSTS and no downgrade to older suites. Inbound webhooks must present an HMAC-SHA256 signature over the raw body plus a timestamp within a five-minute window, and delivery IDs are cached so a captured request cannot be replayed later. Bodies are validated against a published JSON Schema and capped at 1 MiB before any handler runs, which keeps malformed or oversized payloads away from workflow logic. Rate limits are per-tenant token buckets with burst allowance, so one noisy integration cannot degrade another customer's runs. Requests are tagged with a correlation ID that follows them through every downstream service and appears in your execution timeline, making a failed run traceable to a specific upstream call.
- Transport
- TLS 1.3 only, HSTS enabled
- Webhook auth
- HMAC-SHA256 + 5-minute timestamp window
- Payload limit
- 1 MiB, JSON Schema validated
- Rate limiting
- Per-tenant token bucket with burst
Role-Based Access Control
Five roles, resource-scoped grants, and a deny-by-default check on every privileged action.
Permissions are granted through roles rather than per-user checkboxes that drift. Owner, Admin, Builder, Operator, and Auditor map to distinct jobs: a Builder edits workflow logic but cannot read a stored credential, an Operator can rerun or cancel executions without editing them, and an Auditor gets read-only access to logs and exports with no write path anywhere. Grants are scoped to folders and connectors, so a contractor working on your billing automations sees nothing in HR. Evaluation is deny-by-default and happens server-side on every request, not in the UI, so a hand-crafted API call from a lower-privileged token fails the same way a hidden button would. Role changes take effect on the next request and land in the audit log with the acting admin named; high-impact changes can require a second approver.
- Roles
- Owner, Admin, Builder, Operator, Auditor
- Scoping
- Per folder and per connector
- Enforcement
- Server-side, deny-by-default
- Propagation
- Next request; logged with actor
Multi-Factor Authentication
TOTP or WebAuthn passkeys, enforceable org-wide, with step-up prompts on sensitive actions.
Accounts support RFC 6238 TOTP codes and WebAuthn passkeys, and we recommend passkeys because origin binding makes them resistant to the phishing pages that harvest one-time codes. Owners can enforce a second factor for the whole organization; unenrolled members are blocked at sign-in rather than nagged, and admin roles can be held to passkey-only. Sessions run 12 hours with a sliding idle timeout, and step-up re-authentication is demanded for high-consequence operations — rotating a credential, changing a role, altering log retention, or exporting audit data — so a hijacked browser session cannot escalate silently. Recovery codes are single-use, shown once at enrolment, and their consumption raises an alert to owners. SAML or OIDC single sign-on with SCIM deprovisioning is available on Enterprise for teams that prefer to keep identity in their own directory.
- Factors
- TOTP (RFC 6238), WebAuthn passkeys
- Enforcement
- Org-wide policy; passkey-only for admins
- Session
- 12 hours, step-up on sensitive actions
- Enterprise SSO
- SAML / OIDC with SCIM deprovisioning
DPDP readiness
India's Digital Personal Data Protection Act asks you to prove what happened to personal data. SentryFlow records it as the workflow runs.
Complete audit logs
Every workflow run, connector call, approval and configuration change writes an append-only record carrying actor, resource, timestamp and outcome. Entries are hash-chained, so an edited or removed row fails verification. An auditor sees a filterable log and can export it as signed JSONL for the retention window on your plan.
Consent-aware workflows
Each step declares the processing purpose it runs under. When consent for that purpose is withdrawn, the step halts rather than executing, and the run is marked blocked_by_consent. An auditor sees which records were skipped, under which purpose, and the consent artefact that caused the block.
Data residency
Workflow state, execution payloads and audit logs are stored in the AWS Asia Pacific (Mumbai) region, ap-south-1. Cross-region replication is disabled at the account level rather than by convention. Where a connector's own endpoint sits outside India, that destination is listed in your data map before you can enable it.
Access monitoring
Every human and machine read of customer data is attributed to a named principal and a granted scope. Sessions use short-lived tokens, and privileged actions require re-authentication. A first-seen IP range, a bulk export or an off-hours credential read raises an alert and lands in the log as escalated.
Exportable compliance reports
Generate a period report covering Data Principal request turnaround times, consent withdrawals honoured, blocked and failed runs, and each access to connector credentials. Output is a PDF alongside machine-readable CSV, with row-level references back to audit entries so a reviewer can trace any figure to its source event.
Secure data movement
Payloads travel over TLS 1.3 and rest under envelope encryption via AWS KMS, with a distinct data key per tenant. Connector secrets are redacted at write time and never reach run logs. Fields you mark sensitive are stripped from prompts before any request leaves for a model provider.
SentryFlow supplies the controls, audit trail and exports designed to support your DPDP obligations; it is not a certification and does not shift accountability, so responsibility for compliance stays with you as the Data Fiduciary.
All 7 steps a Data Principal request moves through, including the point where a human withholds records under a legal-obligation exemption and has to record why.
Integrations
Every connector requests the narrowest scope that still does the job.
Gmail
EmailWatches a mailbox for messages matching a server-side filter, extracts fields through a redaction pass before any model call, and drafts or sends replies in the same thread. Attachments are hashed and scanned, never retained past the run.
Google Workspace
ProductivityResolves approvers against your directory so escalations follow a real reporting line, writes run artefacts to a nominated Drive folder, and books calendar holds for change windows. Directory reads are cached for fifteen minutes, never mirrored.
Slack
MessagingPosts run summaries and approval prompts to a named channel, then records the approve or reject decision as a signed event bound to the acting user ID. A rejection halts the workflow and stays in the audit log permanently.
WhatsApp Business
MessagingSends template notifications to customers and reads inbound replies for opt-out keywords in English, Hindi, and Tamil. Phone numbers are tokenised before an AI step runs, so the model receives a reference rather than a subscriber identity.
Razorpay
PaymentsListens for payment, refund, and settlement events, verifies the signature on each callback, then reconciles amounts in ₹ against your ledger before anything downstream fires. Refunds above a configurable ₹ threshold always route to human approval.
Shopify
CommerceReads new orders and fulfilment updates, enriches each with a summary of buyer notes, and writes tracking numbers back to the order. Customer addresses stay masked in run logs and drop out when the retention window closes.
Including 5 more, each listing the events it triggers on, the actions it can take, and the exact OAuth scopes it requests.
All third-party product names, logos, and brands are the property and trademarks of their respective owners, used here for identification only. Reference to them does not imply any partnership, sponsorship, endorsement, or official status.
Product
Every execution carries a risk score, every credential use lands in an append-only log, and anything above your thresholds stops for a named approver. This is the view your security team asks for on day one.
- Total executions
12,847
up 8.2% versus the previous period, an improvement.
- Success rate
99.4%
up 0.4 pt versus the previous period, an improvement.
- Pending approvals
17
down 6 versus the previous period, an improvement.
- Average risk score
0.31
down 0.04 versus the previous period, an improvement.
- API uptime
99.97%
up 0.02 pt versus the previous period, an improvement.
- Active credentials
42
up 3 versus the previous period, an improvement.
Executions by outcome
- Succeeded
- Failed
- Awaiting approval
| Period | Succeeded | Failed | Awaiting approval |
|---|---|---|---|
| W1 | 742 | 28 | 46 |
| W2 | 806 | 24 | 52 |
| W3 | 791 | 31 | 38 |
| W4 | 884 | 19 | 41 |
| W5 | 927 | 22 | 57 |
| W6 | 901 | 17 | 33 |
| W7 | 968 | 14 | 29 |
| W8 | 1042 | 21 | 44 |
| W9 | 1015 | 12 | 26 |
| W10 | 1108 | 10 | 31 |
| W11 | 1174 | 9 | 22 |
| W12 | 1236 | 7 | 17 |
Average risk score
0.31fell from 0.52
| Period | Average risk score |
|---|---|
| W1 | 0.52 |
| W2 | 0.58 |
| W3 | 0.49 |
| W4 | 0.61 |
| W5 | 0.44 |
| W6 | 0.47 |
| W7 | 0.38 |
| W8 | 0.42 |
| W9 | 0.35 |
| W10 | 0.33 |
| W11 | 0.29 |
| W12 | 0.31 |
Recent executions
| Workflow | Trigger | Status | Duration | Risk | When |
|---|---|---|---|---|---|
| GST invoice reconciliation | Schedule · 02:00 IST | Succeeded | 34.6s | 0.18 | 2m ago |
| WhatsApp Business order status replies | Inbound message | Succeeded | 1.4s | 0.07 | 3m ago |
| Razorpay refund above ₹25,000 | Payment webhook | Awaiting approval | 2.1s | 0.74 | 6m ago |
| Meta Lead Ads → Zoho CRM sync | Lead form submit | Succeeded | 3.9s | 0.22 | 9m ago |
| Shopify COD order verification call queue | Order created | Succeeded | 5.2s | 0.16 | 12m ago |
| Supplier invoice extraction from Gmail | Gmail label: Invoices | Failed | 8.7s | 0.41 | 18m ago |
| Warehouse reorder alert to Google Sheets | Stock threshold | Succeeded | 6.3s | 0.09 | 24m ago |
| Vendor onboarding PAN and GSTIN check | Form submit | Running | 11.8s | 0.35 | 27m ago |
| Customer erasure request intake | DPDP portal request | Awaiting approval | 0.9s | 0.62 | 38m ago |
| Failed UPI mandate escalation to Slack | Mandate webhook | Succeeded | 0.8s | 0.27 | 45m ago |
| Dealer payout batch summary | Schedule · hourly | Succeeded | 22.4s | 0.48 | 1h ago |
| Support ticket triage and sentiment tagging | Inbound email | Succeeded | 4.6s | 0.13 | 1h ago |
| Distributor price-list broadcast | Manual run | Failed | 41.9s | 0.86 | 2h ago |
| Monthly TDS working paper assembly | Schedule · month end | Succeeded | 38.2s | 0.31 | 3h ago |
Audit log
| Actor | Action | Resource | Outcome | When |
|---|---|---|---|---|
| Ananya Rao | workflow.publish | wf/gst-invoice-reconciliation@v14 | Allowed | 4m ago |
| svc/razorpay-connector | credential.decrypt | cred/razorpay-live-key | Allowed | 6m ago |
| svc/refund-runner | scope.request | scope/payments.payout.write | Denied | 7m ago |
| Vikram Iyer | approval.decide | exec-8410 · refund ₹48,200 | Escalated | 11m ago |
| Meera Kulkarni | export.audit_log | audit/2026-07 · 41,208 events | Allowed | 19m ago |
| svc/gmail-ingest | credential.decrypt | cred/gmail-oauth-refresh | Denied | 23m ago |
| Rohit Deshmukh | policy.update | policy/refund-ceiling-inr | Escalated | 31m ago |
| svc/dpdp-intake | erasure.queue | principal/8f31c2 · 6 systems | Allowed | 38m ago |
| Fatima Sheikh | connector.authorize | connector/zoho-crm · 3 scopes | Allowed | 52m ago |
| svc/model-gateway | model.invoke | step/support-triage · redacted payload | Allowed | 1h ago |
| Karthik Menon | secret.read | cred/payout-signing-key | Denied | 1h ago |
| svc/key-rotator | key.rotate | kms/envelope-key · 3 credentials | Allowed | 2h ago |
| Priya Nambiar | role.assign | user/ops-intern-04 → approver | Escalated | 3h ago |
| svc/distributor-broadcast | workflow.rollback | wf/price-list-broadcast@v9 | Allowed | 3h ago |
4 open security signals
- High severity7m ago
Service account requested a scope outside its grant
A service account asked for Razorpay payout scope beyond its policy grant twice within four minutes. Both requests were denied and the token was quarantined pending owner review.
- High severity22m ago
Instruction override attempt in an inbound email
An inbound supplier email contained instructions to forward the credential vault export. The AI step flagged it, dropped the instruction, and routed the message to human review.
- Medium severity1h ago
Refund exceeded its configured ceiling
Refund workflow attempted an amount of ₹48,200, above its ₹25,000 ceiling. Execution paused at the approval checkpoint and now waits on the finance owner.
- Low severity5h ago
Three credentials near their rotation window
Three connector credentials cross their 90-day rotation window this week. Rotation is scheduled for Sunday 02:00 IST; workflows continue running on the current keys until then.
Pricing
Every plan includes approval gates, envelope-encrypted secrets, and an immutable run log. Paid tiers add retention, identity controls, and rotation. Move up when your auditor asks for more history, not to unlock basic safety.
Free
₹0/month
Run one real workflow end to end, with approvals on, before you spend anything.
- Runs / month
- 500
- Seats
- 1
- Connectors
- 3
- Audit retention
- 7 days
- 500 workflow runs a month across up to 3 connectors
- Single-approver gate on any step that writes to an external system
- Immutable run log with the exact payload each step saw, kept 7 days
- Credentials stored as envelope-encrypted secrets, never in workflow JSON
- Data processed and stored in the Mumbai (ap-south-1) region
- Community forum support and the full product documentation
Starter
₹1,999/month
For a small ops team automating the daily queue without losing the paper trail.
- Runs / month
- 10,000
- Seats
- 3
- Connectors
- 8
- Audit retention
- 30 days
- 10,000 runs a month, 8 connectors, 3 seats with 3 preset roles
- 30-day audit retention, exportable to CSV or JSON by any Admin
- Named approvers per workflow, with the approval decision written to the run log
- Manual secret rotation with a re-key that leaves running workflows intact
- AI steps redact configured PII fields before the prompt leaves your tenant
- Email support with a 2-business-day first response
Growth
Most popular₹5,999/month
The tier most teams settle on: multi-step approvals, a sandbox, and 90 days of audit.
- Runs / month
- 100,000
- Seats
- 10
- Connectors
- 20
- Audit retention
- 90 days
- 100,000 runs a month, 20 connectors, 10 seats across 6 preset roles
- Multi-step role-based approvals with escalation after a configurable timeout
- Google and Microsoft OIDC sign-in, plus IP allowlisting on the console and API
- Scheduled 90-day secret rotation with drift alerts when a credential goes stale
- One sandbox environment with its own secrets, so tests never touch production data
- HTTP and webhook connector builder for internal services, request signing included
- Email and chat support with an 8-business-hour first response
Business
₹14,999/month
For regulated teams that have to hand an auditor a year of evidence on request.
- Runs / month
- 500,000
- Seats
- 40
- Connectors
- Unlimited
- Audit retention
- 1 year
- 500,000 runs a month, unlimited connectors, 40 seats with custom role definitions
- SAML 2.0 single sign-on and SCIM provisioning, so leavers lose access on deprovision
- Quorum approvals (any 2 of 3 approvers) on payment, refund, and customer-data steps
- 30-day scheduled rotation plus on-demand rotation from the API or console
- One-click DPDP evidence pack: consent state, access requests, erasure jobs, approver identities
- Audit log streaming to your own SIEM over HTTPS, with replay for missed windows
- Priority support with a 4-business-hour first response and a named onboarding engineer
Enterprise
Enterprise is quoted after a scoping call
Dedicated tenancy, contractual response times, and retention measured in years.
- Runs / month
- Custom
- Seats
- Unlimited
- Connectors
- Unlimited
- Audit retention
- Up to 7 years
- Dedicated tenant in the Indian region of your choice, isolated at the VPC boundary
- Encryption keys in an AWS KMS custom key store backed by HSMs you can revoke
- Break-glass access under dual control, time-boxed, and logged to your SIEM as it happens
- Attribute-based access rules on top of custom roles, plus enforced MFA through your IdP
- Private connectors built and code-reviewed with your team, deployed to your tenant only
- 24x7 support with a contractual 1-hour P1 response, quarterly architecture reviews
- Retention configurable to 7 years, with legal hold that blocks scheduled deletion
Enterprise is quoted after a scoping call: run volume, residency, retention window, and how your IdP handles break-glass. Expect a written architecture summary before any contract.
Prices in INR, exclusive of GST. GST at the applicable rate is added on your invoice.
14 capabilities compared row by row, with the run quotas, seat counts, and audit retention windows for every tier.
The review process
An automation platform is not bought by one person. Five functions each block on a different question, and the honest version of this page is the question itself rather than a quote from someone praising us. Each answer below is a mechanism you can test in a sandbox tenant, followed by what that mechanism does not cover.
What is the blast radius when one credential leaks, and how much of my estate does it reach?
Chief Information Security Officer
Holds the veto
The mechanism
Each connector carries its own scoped token, requested per workflow and listed in plain text before you authorise it. Secrets sit in an envelope-encrypted vault whose plaintext exists only inside a single execution step, never in the browser and never in workflow JSON. Revoking one credential stops one workflow rather than fourteen, and deleting a connector destroys its data key.
Where it stops
Containment is not reversal. Whether an action can be undone depends entirely on the target: a Slack message can be deleted, a captured payment cannot.
Who actually holds the keys, and can the engineer on call replay a failed run at 2 a.m. instead of reconstructing it?
CTO and VP Engineering
Technical influencer
The mechanism
Per-secret data keys are wrapped by a per-tenant AWS KMS customer managed key, so rotation runs on your schedule against your key rather than through a vendor ticket — 90 days by default, 30 for payment connectors, with a 60-minute overlap window. Retries inside a run are idempotent, failed runs park with their full input payload, and execution history leaves as structured JSON for the SIEM you already operate.
Where it stops
Breaking upstream API changes are the honest weak point. A connector cannot absorb a provider's incompatible release, and a workflow depending on it will fail until the connector is updated.
Reviewers do not accept screenshots. What can I put in front of them, and how long does assembling it take?
Compliance Manager and Data Protection Officer
Usually the champion
The mechanism
Every run, configuration edit, approval, and denial writes to an append-only, hash-chained log — denials recorded as loudly as successes, and a tampered row breaks verification for everything after it. Export is a self-serve function on every paid tier rather than a support ticket, and the exports are themselves logged. Retention runs from 7 days to 7 years by tier.
Where it stops
Erasure is partial by design. Payloads purge from primary storage and searchable history, but audit entries stay append-only, and encrypted backups roll off on a 35-day cycle — so a deleted payload can persist for up to 35 days. If you need shorter, say so before signing rather than after.
Can this run unattended overnight without moving money by accident while nobody is watching?
Head of Operations
Owns the outcome
The mechanism
Model output is treated as a proposal, not an instruction. Every tool call is scored on blast radius, data sensitivity, and rupee value, then auto-run below 30, queued for a named approver between 30 and 70, or hard-blocked above it. Payments above ₹25,000 always wait for a human. Nothing times out into execution: an unanswered approval escalates after 4 hours and expires as a denial at 24.
Where it stops
The friction is deliberate and it is felt. Scope prompts and approval gates make the first build slower than a platform optimising for time-to-first-automation, and a queue with no attentive approver simply stops.
Where is your SOC 2 report, and are you telling me this platform makes us compliant?
Procurement and Legal
Final gate
The mechanism
We hold no SOC 2 report, no ISO 27001 certificate, and no STQC attestation, and we will not imply otherwise on a call. What your reviewer receives instead is a completed CAIQ-style questionnaire, an architecture document covering key management and tenant isolation, our access-review and change-management procedures, a subprocessor list with regions, and read-only access to a sandbox tenant so controls can be tested rather than read about.
Where it stops
No vendor can be compliant on your behalf. Obligations under the DPDP Act sit with you as Data Fiduciary; this platform is designed to support them and to make them evidenceable. If a certificate is a hard procurement gate, tell us in week one — we would rather lose the deal there than at legal review six weeks in.
Built around these operating patterns
Sectors the platform is designed for, drawn from the solution pages and connector catalogue. Not a customer list.
- NBFC lending and collectionsCollections contact inside regulatory limits
- D2C retailRefund approval above a set rupee ceiling
- Diagnostics and healthReport delivery touching sensitive personal data
- Lending infrastructure and fintechKYC document handling that must stay in India
- Agri supply chainVendor invoice reconciliation before the team logs in
- Fleet and mobilityDriver payout runs with a human above threshold
- Industrial IoTAlert triage routed on evidence rather than keywords
- Apparel manufacturingPurchase order exceptions escalated to a named owner
Questions
The answers below concede limits where they exist: what a KMS outage does to a running workflow, what stays in backups after a deletion, and which obligations remain yours under DPDP. If your reviewer needs deeper detail, our architecture document and subprocessor register are available before you sign anything.
Security
AI approvals
Compliance
Including 7 more on data residency, migration, enterprise support, and what each control does not cover.
Secure Every Automation Before It Runs.
Deploy AI workflows with per-step approval gates, scoped credentials, and an immutable audit trail. Start on a paid tier today or walk through a scoped enterprise rollout with our team.
Talk to us
Book an enterprise demo
Bring your security questionnaire. We will walk through the credential vault, approval gates, and the audit trail your team would actually be signing off on.