Prompts, repository access, and model calls go through OneWorld's gateway. The sections name who can open a record, where the stack runs, what is logged, and how you check the app on a machine.
The gateway
Prompts and the code an agent reads go through OneWorld's own inference gateway, not from a laptop straight to a model API.
Every request is inspected for prompt injection, and attempts are flagged before they reach the model.
Every request is inspected for sensitive data. If that detector fires, the request is routed to a self-hosted model, either automatically or after the person confirms.
Every plugin is scanned. The check reports what the plugin does, including behavior that would not be obvious from its listing.
Where it runs
Components can run in OneWorld's managed cloud, or in your cloud or IDC.
Database. Cloud uses Firebase and BigQuery. Self-hosted uses Supabase and ClickHouse.
Agent. Cloud uses Claude Code, Codex, or an agent you bring. Self-hosted can use the OneWorld AI Agent.
Agent sandbox. Cloud uses E2B in the cloud. Self-hosted uses E2B in your cloud or IDC.
Model. Cloud uses AWS Bedrock. Self-hosted uses an open-source model.
What is recorded
Sensitive operations, LLM calls, sandbox starts, and data-analysis tasks are written to an audit trail.
Operational telemetry records identifiers, timings, event types, and error codes. Prompts, code, and message bodies are not sent to that pipeline, and secrets are scrubbed from logs.
The app you run
You can check that the app on a machine is the app we built.
Enterprise builds ship on their own release channel. Versions are pinned, so what you run stays on the build you accepted.
Builds are reproducible: the same source tree produces the same artifact digest. Checkouts and dependencies are pinned to commit SHAs and content digests. Release artifacts are signed, checked at install and at launch, and signing keys are rotated. Commit signing is required on protected branches and checked in CI.
Who can open what
Most operations follow a company role. Core records, including thinking traces, use relationship-based access (ReBAC), so access is decided by the relationship between a person and that record, not only by job title.
A session is opened by its owner and by the teammates granted editor or viewer access. Grant that access with Share.
How people sign in
Sign-in is enterprise SSO through WorkOS, on every client surface.
Session and token lifetime is configurable per client policy, from 10 minutes to 7 days.
When a role or membership changes, de-provisioning takes effect within 10 minutes.
MFA is available for account login and for sensitive operations.
The desktop app signs in with a device code, so the secret is not typed into a window that can be hijacked.
Data through its life
What goes into a model, what comes back, analysis results, and erasure all sit under the same relationship-based access.
A session that ran only on a computer stays on that machine until someone uses Share, and Share copies a mirror into OneWorld.
A session can be deleted. Deletion is destructive, needs confirmation, releases the runtime, and removes that session's data.
You can set a retention period, and when a session reaches it, it is deleted automatically.
Releasing or archiving a session tears down compute and keeps the history until it is deleted.
GitHub
Connecting GitHub is covered on Integrations.
The GitHub token is stored encrypted. Encryption uses the organization admin's permission, a salt, and a KMS secret. OneWorld checks the GitHub App's grants before it calls GitHub.