Growth you own. Data you keep.

Bring your own model

Every provider is reached through the same OpenAI-compatible interface, so switching is a setting, not a migration. Point InRoots at a local Ollama and check-in text never touches a public API.

Data flow

• Input: chat messages from your Matrix server, or bridged Slack and Teams workspaces
• Processing: parsing, scoring, coaching rules and the neural layer run inside the InRoots container on your infrastructure
• Model calls: only the text a feature needs, to the provider you chose; a local model means none leave the host
• Storage: SQLite or Postgres, yours; integration credentials encrypted at rest
• Output: dashboards, direct messages, exports, and the signed webhooks you configure
• Nothing else leaves: no telemetry, no usage beacons, no crash reporters calling out

What the model sees, and what it never sees

A model call carries the check-in text being parsed, the period's check-ins and totals for a weekly narrative, the question typed into Ask AI with the data needed to answer it, or a blocker sentence being routed. It does not receive HR document contents, source code, email, files or screens. Ask AI conversations are stored on your server, scoped to the user; administrators can see that a question was asked, not the answer body.

• InRoots does not collect your data and does not train any model of its own on it
• Whether a third-party provider retains prompts is governed by that provider's terms; a local model removes the question
• Anything you paste into Ask AI is sent as typed, so the product tells users not to paste secrets

Token budgets and memoisation

Every outbound model call is counted per day and shown on the dashboard. An admin-set daily budget refuses non-essential calls (intent routing, AI detection) once reached, and every such caller degrades to keyword or heuristic paths; summaries and Ask AI are never budget-gated. Deterministic classifications are memoised for hours so the same message never costs twice. Because the score is arithmetic, inference cost stays near zero even on paid providers.

On-host geo and IP intelligence

A local IP database — keyless db-ip Lite or MaxMind, refreshed on your host by a weekly script — classifies office, home, mobile and VPN on-host; no employee IP ever leaves the server. IPv6 is keyed on the /64 so a home line is recognised as one recurring network. Location is consent-gated and visible to the employee it concerns; if the database is absent, geo signals stay neutral rather than guessing.

Signed consent

Policies are versioned. Each signature binds the person to a content hash of the exact title, version and body they read, so a later edit cannot be passed off as already accepted. Location sharing and any capture feature are off until the person signs, and revoking stops them immediately.

Audit

Every bot action, admin override, weight change, consent signature, auto-approval and login lands in an audit log with who, what and when. Strike rows are append-only; when the scorer later waives one, the waiver and its reason sit beside it. The log is filterable, sortable and exportable, and every metric in an employee drawer opens the exact rows it was computed from.

Access control

• Five roles: employee, team lead, manager, admin, superadmin; HR sees documents by role
• One-time codes for sign-in, trusted-device sessions, personal API tokens stored only as a hash and scoped to what the owner may see
• Read-only tokens are refused anything that writes; revocation takes effect on the next request
• Single sign-on available on enterprise and self-hosted deployments
• Outbound webhooks are signed with a shared secret you verify on receipt

No telemetry

The product does not phone home. There are no usage beacons, no crash reporters calling out and no hidden analytics. Zero bytes leave unless you configure a destination.

Reporting a vulnerability

Write to security@inroots.ai. We acknowledge reports and keep reporters informed until the issue is closed. Public certifications are listed here only once they are issued; we do not display badges we do not hold.