Sales › Offer templateread by: Management
Offer template
Structure of an offer for new customers. Prices according to the current scale, contact person as per Project Nordlicht.
The salary bands from the HR area are embedded:
Sales › Offer templateread by: Anna, Sales
Offer template
Structure of an offer for new customers. Prices according to the current scale, contact person as per not released – request access.
The salary bands from the HR area are embedded:
The embed is missing entirely here: the HR area is hidden – no title, no placeholder, no trace.
Example from the fictional sample company. Links into open areas become a placeholder, links into hidden areas disappear. Backlinks, tags, graph, search, chat answers and MCP follow the same rule.
Three independent protection layers on every query
Layer 1SQL prefilter
The query asks only for notes the reader may see.
Layer 2Row-level security
Postgres filters on its own – with an app role that has no bypass rights.
Layer 3Recheck
Every result is checked once more against the permission model before delivery.
If one layer fails, the others catch the error. When in doubt nothing is delivered, and “not visible” answers exactly like “does not exist”. This is tested with canary markers across all outputs, for every user and every channel.
Permissions
Permissions that live in files
Who reads, writes and administers what is stored in the content itself – versioned and traceable.
- Areas are folders.An
_bereich.mddefines groups for reading, writing and administering. If a value is missing, the strictest value applies.--- lesen: [vertrieb, gf] schreiben: [vertrieb] tote_links: verdeckt llm: nur_lokal ---
- Individual notes only restrict.
zugriff:in the frontmatter makes a note narrower, never wider. Empty or invalid means: nobody. - Three channels.Internal (UI, local language model), external (MCP, cloud models) and device. Areas with
llm: nur_lokalnever go to an external model. - Derived pages inherit their sources.Readers are the intersection of the area and all sources, also across several levels. If a source is restricted, the page follows on the next run.
- Area type “sensitive”.For areas with particularly sensitive data (HR, health, whistleblowing), the type
typ: sensibelenforces an in-house model, no sync to devices and hidden links. Contradictory settings are named in the indexer report; the stricter value applies. - Permission overview as an export.Administrators export the permissions of all their areas (groups, settings, version, time) as a table or JSON – without content, as evidence of the documented access rules.
Finding and asking
Search, chat and hard facts
Every hit runs through the permission filter before it counts.
- Hybrid search.Vector similarity with bge-m3 (1024 dimensions) plus full text for exact terms. Deliberately without a vector index – otherwise the number of hits and the run time would depend on notes the reader cannot see.
100,000 chunks Workers p50 p95 half visible 2 98 ms 106 ms all visible 2 178 ms 182 ms all visible 4 124 ms 128 ms - Chat with sources.The answer is based only on notes the asker may read – with a local language model also across local-only areas.
- Figure check.Under every answer it says whether its figures, amounts and dates appear in the sources – checked without a language model, in any notation (€1,382.43 as 1.382,43). Invented values and source numbers are flagged. The model does not calculate itself but names the values with their reference.
- Hard facts.Date, amount with currency, correspondent and document type, for example from receipts: filter, count, total per currency. Calculation happens only after the recheck.
- Earlier versions.Every change keeps the superseded version with its validity period, for an adjustable period (default one year). A version is visible only if you were allowed to read the note both today and then. Administrators can redact or delete individual versions, which is logged. The history is therefore traceable but not immutable and not an audit-proof archive; time-stamped evidence is planned as a separate module.
AI and agents
Claude and agents via MCP
Agents read with the permissions of their user and cannot spread what they have read any further.
- MCP server with ten tools.Read, search, evaluate facts, track changes and make proposals.
searchread_notebacklinkslist_areasfactschangespages_ofsources_ofpropose_notepropose_change
- Claude as a connector.In claude.ai, Claude Desktop, Claude mobile and Claude Code – signed in through the company account.
- Connect your own tools.Agents and editors such as Hermes, Cursor or OpenClaw each get their own access – with the permissions of the person signing in, always in the external channel and individually revocable.
- Protection against prompt injection.The server remembers per session what an agent has read. A proposal never becomes readable by more people than its sources, and anything read in local-only mode never reaches the outside.
- Inbox.Proposals from agents wait for approval; changes come with a line comparison against today's text.
- Maintenance agent (LLM wiki).Keeps derived pages up to date with their sources – with a service account, a token budget per day and month, and only what all readers of the page may see.
On the go
Speak questions, hear answers
The interface runs as an app on the phone – no typing needed.
- Voice in chat.Tap the microphone and ask – the recording ends after a short pause, the question is sent straight away, and the answer is read aloud.
- In-house speech recognition.Selectable per instance: a dedicated service on the server (the recording does not leave the company, about 3 seconds per question on an ordinary CPU) or the phone's own recognition. Recordings are not stored anywhere.
- Reading aloud on the device.Text is read aloud only with voices running on the phone – the answer text goes to nobody else.
- Installable as an app.On phone and desktop, sign-in with passkeys, in German and English.
Administration
Administering does not mean reading along
Restricting is immediate, widening never alone.
- Four-eyes principle.Every widening of permissions needs a second person; approvals expire after 7 days or when the file changes.
- “View as”.Administrators check the view of specific groups – but only within what they can see themselves. Writing and administering are suspended meanwhile.
- Everything through jobs.The web app never changes anything itself; the indexer checks every job and is the only writer. Every change is logged.
Obsidian
Working in Obsidian
A plugin brings released knowledge to the device – and changes back.
- Download only what is allowed.Areas with
endgeraete: sync_erlaubt, only content that may go outside. If the device is blocked, the plugin removes everything. - Edit and upload.Authors edit notes in Obsidian and publish new ones with a command. Hidden links are kept as a neutral marker without revealing their target.
- Nothing is silently lost.Conflicts become a conflict copy, rejected changes land in the trash.
Integrations
Connected to what is already there
Accounts, groups and receipts come from the company's systems.
- Microsoft Entra ID.Users and groups via SCIM, sign-in through Entra. Anyone deactivated in Entra loses their sessions.
- Paperless-ngx.Receipts come with their Paperless groups – never “for everyone”. What Paperless deletes or withdraws disappears.
- Keycloak.Sign-in via OIDC with passkeys and MFA for administrators, the sign-in page in the app's design.
Privacy
Built with the works council in mind
Subject to co-determination – and built so that the works agreement becomes simple.
- Read log under a works agreement.Off by default, pseudonymous and time-limited, if desired only for individual areas. A hash chain makes changes visible.
# _instanz.md lese_protokoll: bereiche lese_protokoll_tage: 90 protokoll_pruefer: betriebsrat
- Evaluation only with four eyes.The administration applies, the review group confirms. Revealing a pseudonym needs a separate request and the review group's private key, which the server never has.
- Nobody is logged secretly.The interface shows it on every logged note, and everyone sees their own reading history.
- Sparse traces.Active users per month without personal reference, sign-in events 30 days, sessions only hashed. All reading traces are described for the works agreement.
- Retention.The log of permission changes is deleted automatically after an adjustable period (default one year); the deletion itself is logged. Versions, read log and sign-in events have their own periods. Backups and copies on devices are governed by the instance's deletion concept.
Operation
One instance per customer
The same stack hosted on servers in Germany or in your own data centre.
- Compose stack.Caddy with Let's Encrypt, Keycloak on its own subdomain, Postgres with pgvector, embeddings on the CPU without internet access.
- Language model and third countries.The server location applies to the instance. If a customer uses a cloud language model, its provider processes the excerpts sent along; provider, processing region and legal basis (EU region, Data Privacy Framework or standard contractual clauses, Art. 44 et seq. GDPR) are named before use and recorded in the data processing agreement, as is non-retention at the provider. Areas with
llm: nur_lokalnever go to a cloud model. - Hardened.Containers without root and without a shell, read-only; database and indexer in a network without internet; strict CSP, no content in logs.
- Backup and restore.Encrypted with age, plus self-test and incremental indexing via a file watcher.
- Versioned.SemVer, changelog and images per version; several instances on one host behind a shared edge.
Deliberately documented limits
- Offline on the device The instance does not see what has been read there – only the download is recorded. Areas in which every read access must be logged therefore stay off the device.
- The figure check checks figures, dates and source numbers – not whether a statement without a figure is true. It shows findings instead of discarding answers.
- The server administrator can read around the log. Who has server access and for what belongs in the works agreement or the data processing agreement.
- Not a reporting channel. Company Brain can hold the procedural rules for whistleblowers, but does not replace a reporting office under the German Whistleblower Protection Act. Case files belong in a separate, strictly isolated area (
typ: sensibel, narrow circle of readers). - Not for personnel decisions. Company Brain is a knowledge tool and is not intended to decide on hiring, promotion or dismissal or to assess the performance and behaviour of individuals. Under the EU AI Act, DOT MG is the provider of the system and the customer the deployer; the obligations for the language model lie with the model's manufacturer. Answers are permanently marked as AI answers in the chat.
Interested in a demo?
Company Brain is in beta. We are happy to show it on the sample company – write to us.