An AI inside an HR system needs hard boundaries — not soft ones in a prompt. Flo's are enforced in the architecture, not the policy document.
Every tool call inherits the asking employee's permissions. Flo can't see records you can't see. The audit log records you, not Flo. There is no shared service account behind the curtain.
Submitting leave, sending an email, generating a SARS form — Flo proposes, you confirm. Admins can elevate specific tools to auto-confirm within stated policy.
Performance ratings, salary changes, hiring decisions, terminations — Flo can draft, summarize, and prepare. The decision sits with you, with evidence and calibration.
We use frontier LLMs with zero-retention API access. Customer prompts and responses are never used for training — by us, our providers, or anyone downstream. Contractually committed in our DPA.
When Flo summarizes survey themes, it cannot reach back to who said what. The boundary is enforced in the database with row-level security, not in a prompt.
Don't want Flo touching payroll? Turn off the tool group. Don't want auto-approvals? Turn them off. Granular, per-customer, in plain settings.
Every multi-step interaction has a trace. You can see what Flo retrieved, which tools it called, and why. Replay the same context against a future model to compare.
No single user, tool, or tenant can run away with Flo. Per-tool rate limits. Anomaly detection. Auto-pause on spikes, with admin notification.
A prompt that says "don't see other tenants" is theatre. A postgres RLS policy that physically can't return another tenant's rows is engineering.
Every table is scoped at the row level by tenant_id and, where relevant, by employee_id. Flo's tool layer sets the connection user to the asking employee before any query runs. No tenant_id parameter is needed because no tenant_id parameter is trusted.
“The thing that sold us was the audit log. Every Flo action recorded as me, not as Flo. We knew where the responsibility sat.”
See Flo's full architecture in our Trust Center, or talk to our team.