Privacy and permissions

SRVO uses access rules to decide which workspace content a person can see or change. The rule can depend on their Role, team, space, record, or field. This page explains the product design in plain language. It is not a legal statement.

What controls access

A workspace assigns each person a role, such as Owner, Admin, Member, Limited, or Guest. Teams and spaces can further limit which work appears. A shared item may have its own access level. Field rules can hide or make specific values read-only.

Guests and clients see only items shared with them. Internal comments and hidden fields are not shown to guests. Search results follow the same visibility rules as the item itself. Access can also affect exports and actions offered in the interface.

Agents and connections

An AI agent should act within the access of the person it represents. The interface can ask for review before a destructive or bulk change. API keys and MCP connections are shown with scopes so an administrator can review what a connection may access.

Saved permissions

In a connected workspace, saved roles and permissions apply across the interface, API, MCP, and sync. Owners keep owner access, and SRVO prevents changes that would leave the workspace without an owner. Settings shown in a preview or demo may not be saved or enforced.

Technical error reports

SRVO collects technical diagnostics to fix failures. Reports contain internal workspace/member, item/action/request ids, a hashed session id, build release, route templates, status codes, durations, error class, a redacted message and code-only stack. Browser reports can include browser/OS/device category, viewport, locale, time zone, network type, device memory, sync state, boolean feature flags, the last 50 stable UI event ids and the last 20 API call summaries. Console warnings/errors include their type, without console arguments.

Reports exclude typed text, record/note/file contents, search terms, Sergio prompts/answers, emails, passwords, tokens, raw URLs, query strings and screenshots. Unknown fields are discarded. Strings pass secret/content guards. Arbitrary exception messages are replaced with a fixed message. Staff can read the reports. Error samples expire after 30 days. Inactive groups and their affected workspace metadata expire after one year. Samples are limited to 100 per group per day and 32 KiB of context. Self-hosted reports stay in the local database and are never uploaded to SRVO.