Security and governance
Built so you can see, check, and control every action
Mesa keeps each firm's data apart, stores it in the United States, and records every agent action. Your data is never used to train AI models. This page explains how, in plain words.
Audit log
Kepler account · Today
- 09:41:02 Drafting Searched client documentsNeeded the Q3 statements and the last meeting notes.
- 09:41:09 Drafting Drafted the summaryUsed the firm's quarterly summary template.
- 09:41:14 Compliance Checked against firm rulesOne phrase replaced. Rule: never promise returns.
- 09:42:30 Guardrail Stopped an email to the clientSending to a client needs a person's approval. Stopped
- 09:43:05 Dana R. Approved the summaryReviewed by a person before it was sent.
Oversight Session reviewed. The stop worked as intended.
Our commitments
Six things Mesa does for every firm
These are not settings. They are how Mesa is built, for every firm.
Never used to train AI models.
Your documents and client facts are used only to do your firm's work.
Each firm's data is kept apart.
Every request is checked against the firm it belongs to. One firm cannot see another firm's data.
Stored in the United States.
Mesa stores your firm's data in data centers in the United States.
Every action is recorded.
Each agent action goes to the audit log, with the time and the reason for it.
Agents stay inside their limits.
Guardrails stop any process that moves outside its scope.
People make the final call.
Drafts wait for review. Facts that Mesa is not sure about wait for a person.
Governance
Control before, during, and after the work
Governance is not one feature. It is three checks that run on every task.
Before
You set the limits
You set the rules, the tools, and the models. Guardrails hold every agent to them.
During
Every action is recorded
Every action is written to the audit log, with its reason. Actions outside the rules are stopped.
After
Built-in oversight reviews the work
A second agent reads each finished session and reports errors that repeat, to Strata and to you.
Oversight reports
See what went wrong, and what was done about it
Built-in oversight is a second agent. It never takes part in a live conversation and cannot change an answer. It reads each finished session and writes down what it sees.
- Errors that repeat, and where they happen
- Hand-offs between agents that dropped something
- Tasks an agent handles badly
Oversight report
Week of 5 October
The oversight agent read every finished session this week. It found three things worth your attention.
- Repeated errorWatch The drafting agent left out a required disclosure in 2 letters. The compliance check caught both before review. No letter went out without it.
- Hand-offReported to Strata A note from the compliance agent did not reach the drafting agent. Found by reading the whole session in order. A single step looked fine on its own.
- Working wellGood Meeting prep was approved without changes most of the week.
Sent to Strata and to your firm's admins
Your controls
Your admins decide what Mesa can do
These settings belong to your firm. Your admins change them in Mesa's Settings.
Only firm admins can change who has access, the rules, the models, and the connections. Everyone else on your team works inside the limits they set.
Settings
Your firm
Team accessAdd and remove people. Choose who is an admin.Admins only
RulesWrite the rules every draft must follow, in plain words.Admins only
ModelsChoose which AI models Mesa may use.Admins only
ConnectionsChoose which tools Mesa can reach. Remove a connection at any time.Admins only
For IT and compliance reviewers
The details
The short version for your IT lead or compliance officer. Ask us for anything that is not here.
- Data location
- Stored in the United States.
- Data separation
- One shared database with row-level security. Every query is limited to the firm's own records. Files are kept in a separate folder for each firm.
- Model training
- Client data is never used to train AI models.
- Audit log
- Every agent action, with the time, the agent, the action, and the reason.
- Human review
- Drafts wait for review. Uncertain facts and record merges wait for a person. Mesa never merges records on its own.
Questions welcome
Bring your hardest security questions
We will walk your team, or your IT reviewer, through how Mesa protects your firm's data.
What we can cover
- Where your data is storedUnited States
- How each firm's data is kept apartEvery request
- What the audit log recordsEvery action
- Who makes the final callYour people
- Your security questionnaireSend it to us