Your Office is isolated
Organization data stays inside its own tenant boundary.
Opening The Office…
Return to The OfficeOne place to operate your business
Your work belongs together.
Customers, projects, tasks, orders, invoices, and payments—connected inside one secure Office.
Sign-in, account registration, MFA, and recovery are handled by our trusted identity provider.
YOUR OFFICE
RelationshipsCustomers and counterparties
WorkProjects, cases, and tasks
CommerceOrders through payment
Tenant protected · actor attributed · audit ready
Actions have an owner
Every consequential change is attributed to a person or system actor.
Your work stays connected
Every room uses the same shared organizational truth.
We couldn’t open The Office
Something needs attention.
Please try again.
Switch between active Offices or open the restricted lifecycle view when ordinary access is paused.
Welcome to The Office
Where would you like to work?
Select an active Office or establish a new one.
Establish your Office
A secure home for your organization.
These choices establish your Office identity and regional business defaults. You can refine operating settings later.
- 1
Office profileName and secure address
- 2
Operating defaultsRegion, time, and currency
- 3
Protected activationMembership, actor, and permissions
Protected activation
We’re preparing your Office.
Reserving your organization and establishing its security foundation.
- Operation
- Pending
- Phase
- Starting
- Status
- In progress
A protected invitation
Join this Office.
Your signed-in email must match the invitation. The Office will establish your membership, actor, and assigned role together.
Office overview
Welcome to your Office.
Your operating foundation is ready.
Security context
Actor establishedAuthenticated and attributedEffective capabilities
—Server-evaluated permissionsFoundation
HealthyTenant lifecycle activeOffice Home
Action Center
See the work that needs attention in your current scope, then continue in the room that owns it.
Loading the work visible to you…
Open tasks
—Visible and not completedInvoices due
—Visible invoices with an amount dueDocument attention
—Visible files not yet cleanUnread updates
—Visible and not read or dismissedWhat needs attention
Priority queue
What changed
Recent work
Personal Office P1
Run the business from one connected thread.
Know the customer, organize the work, retain its documents, invoice it, record payment, and find the complete history without losing the thread.
Customer→Project→Task→Document→Order→Invoice→Payment→Find
Your connected operating thread
Move from relationship to settled work with documents and history attached to the records that own them.
P1 Connected CoreCustomers and counterparties
One shared record for every important business relationship.
Connected and operationalProjects and action
Turn commitments into clear, attributable work.
Connected and operationalOrders through payment
Keep commercial truth connected from agreement to settlement.
Connected and operationalFiles stay with the work
Upload to private quarantine and expose files only after the established safety gate passes.
Clean-only accessFind the complete history
Search accessible core records, then open their documents, comments, reminders, and safe actions together.
Permission and scope filteredFoundation 0.18
The Daily Desk
Find a connected record, act on it safely, and keep its conversations, documents, reminders, and corrections together.
Search results
—Scoped to your current accessDocuments
—Clean files available to openNotifications
—Reminders and Office updatesScoped search
Office records
Page 1
Saved views
Record workbench
Choose a record
Select a result to bring its safe actions and connected evidence into focus.
Connected evidence
Comments
Document safety
Files
Attention
Notifications
Personal Office P1
Personal Office Core
The Golden Workflow, Document Vault, Unified Search, and connected history in one protected journey.
- 1 Customer
- 2 Project
- 3 Task
- 4 Document
- 5 Order
- 6 Invoice
- 7 Payment
- 8 Find
Loading this Office's language, time-zone, and currency defaults.
Relationships
Know the customer
Establish the shared relationship record that every later step will reference.
Customer register
Work
Turn the promise into action
Connect a project and task to the customer, then advance the task through guarded states.
Projects
Tasks
Commerce
Carry the same truth into settlement
Confirm the order, issue its invoice, and allocate a settled payment.
Orders
Invoices
Payments
Document Vault & Unified Search
Keep the whole thread together
Attach a file to the record that owns it, then search the Office and reopen that record with its connected evidence. Search covers core record names, not document contents.
Loading the protected document and search boundary.
Connected documents
No target selectedSearch results
Search for a core record to reopen its connected thread.
Evidence
The work remembers
The human activity timeline and immutable security audit remain distinct views of the same attributed actions.
Activity timeline
Security audit
Foundation 0.8
Plans, usage & billing
Understand what this Office includes, how much it uses, and when its subscription renews.
Your Office subscriptionThis is platform billing for The Office OS. It is separate from customer invoices and payments created inside Commerce.
Current plan
—Loading planSubscription
—Loading renewalUsage health
—Loading metersPublished catalog
Plan versions
A subscription always points to one immutable published version. Changing plans is an attributed, replay-safe command.
Billing identity
Account settings
Renewal control
Subscription
Commercial rights
Entitlements
Metered operations
Usage
Platform ledger
Subscription invoices
Foundation 0.9
Delivery & integrations
See the durable work that carries Office events safely beyond the original transaction.
Reliable effectsBusiness records commit first. Delivery can retry safely afterward, and repeated delivery must remain idempotent.
Worker
—Waiting for heartbeatPending work
—Outbox, deliveries, and jobsDead letters
—Explicit replay requiredOutbound events
Webhook subscriptions
Development sinks prove fan-out and retries without sending data outside this environment. External HTTPS delivery remains disabled until its secret reference and network policy are deliberately configured.
Safe local target
Add development sink
End-to-end proof
Execution probe
Queue an attributed, replay-safe job and let the background worker complete it.
Outbound attempts
Recent deliveries
Durable execution
Recent jobs
Published contract
External event envelopes
Foundation 0.20
Portability & lifecycle
Request a complete tenant package, follow independent platform approval, or begin a governed Office closure with a protected cancellation window.
No storage linksThe Office verifies the package provider, size, and complete SHA-256 for every download. Grants expire automatically and can be revoked immediately.
Lifecycle version
—Requests are version boundLatest request
—No request loadedAvailable packages
—Verified and inside retentionOwner request
Request an export
The tenant request is recorded first. A different platform operator must approve it before the isolated worker creates a package.
Verified delivery
Packages & grants
Governed pause
Voluntarily suspend this Office
A voluntary suspension pauses all ordinary tenant execution. The Owner can resume it from the protected lifecycle surface after exact projection acknowledgement.
This is reversibleSecurity and compliance suspensions remain platform-controlled and require an independent decision to resume.
Governed exit
Begin Office closure
Beginning closure pauses ordinary work after the lifecycle projection is acknowledged. You will retain the narrow restricted path for policy dates, eligible cancellation, active-hold summaries, and independently approved exports.
This does not delete dataClosure completion, retention expiry, and deletion remain separate governed decisions. A cooling-off window is recorded with this command.
Foundation 0.29
Security evidence & response
Verify the tenant-disclosable evidence chain, govern accountable incident cases, and preserve evidence without turning a detection into authority.
Observation is not authorityDetections and cases never suspend, revoke, elevate, move, close, export, or delete. Every containment action still requires the separately governed service that owns it.
Unsealed evidence
—Tenant-security partition onlyOpen cases
—Independent review before closureLast verification
—No verification recordedGoverned case
Open an incident
Integrity posture
Seal & verify
A seal binds one ordered batch and its previous digest. Verification recomputes every visible leaf, inventory, batch, and chain.
Accountable response
Incident register
Safe evidence index
Recent evidence & seals
People, access & shared work
Bring people into the work.
Invite a teammate safely, give them an ordinary role, hand off real work, and keep the complete history.
Invite a teammate
Copy this link now
The secret is shown once and is never stored by The Office.
Current team
Memberships
Invitation register
Recent invitations
Foundation 0.26
Human identity federation
Bind an independently verified domain to a governed human identity authority. A domain or provider claim never creates a membership, selects an Office, or grants a role.
Authorization stays inside The OfficeExternal groups, roles, email domains, and tenant claims are never translated into Office permissions.
Foundation 0.25
Service identities
Bind a verified workload identity to a machine-safe role. No password, API key, or synthetic person is created; the external subject is accepted once and never returned.
Machine ceilingTenant lifecycle, people, roles, support, subscription changes, audit, destructive settlement, and service-identity governance remain unavailable to machine actors even if a role is misconfigured.
Foundation 0.27
Credential trust
Bind a provider credential reference to one exact connection, integration actor, provider, purpose, and environment. Secret values are never accepted, returned, exported, logged, or placed in evidence.
Cryptographic boundaryProduction references must be Azure Key Vault secret URIs resolved through managed identity. Rotation activates the replacement while retaining a bounded verification overlap.
Foundation 0.28
Privileged access
Exceptional authority is a separate, short-lived capability set. It never changes a role, never combines with ordinary permissions, and stops on the next request after containment or expiry.
Tenant-governed access
Support requests
Review the operator, case, purpose, exact read capabilities, and expiry. Approval creates a separate support actor—not a membership or role—and may be revoked immediately.