The workshop keeps a ledger.

Apprentices only touch what you hand them, only while a run is open, and everything they do is written down in order. Here is exactly how.

Scoped credentials

Each tool connection is granted per apprentice and per run. A Reader that can see Stripe balances cannot send email, and a credential expires when its run closes.

OAuth scopes · per-run tokens · revoke in one click

An append-only ledger

Every call, every model and every signature is written to a ledger that nothing can edit, including us. Export it any time as CSV or JSON.

hash-chained entries · 7-year retention · export

Where it runs

Runs execute in our EU or US region, your choice per workspace. On Guild, the whole workshop runs in your own cloud and never calls home.

eu-west · us-east · self-host on Guild

What models see

Only the fields a step needs are sent to a model, never whole databases. Providers are contractually barred from training on your data.

field-level redaction · zero retention · DPA