Get a key in one step. It works the moment you get it — start scanning immediately, then sign in to your API dashboard.
One journey · two ways in
Five moves — Classify · Protect · Route · Retrieve · Prove. Start from a table (your database) or a folder (documents): same journey, same proof.
🗂️ClassifyConnect your data
Register a table (or seal a document) — NoData gets the shape, never the values.
POST /api/v1/governance/tables 🔑ProtectGrant an agent
Scoped, deny-by-default — only the columns you name. Mints an ndca- token.
POST /api/v1/governance/grant 🧭RouteDecide before it reads
“May this agent reach X?” — a decision, a cost and a proof, with no data moving.
POST /api/access/decide 📥RetrieveThe agent reads
Only granted columns decrypt; denied ones come back absent, not blanked.
POST /api/agents/<handle>/read 🧾ProveShow it happened
A signed receipt on every read and every deny — verifiable without the data.
GET /decisions · /verify/ref/<ref> We never hold your key; reads and grants are content-blind — every decision releases only the keys your grant allows, and a denied column’s key is never derived.
The same journey, starting from a folder or document (Capsule)
Each document is sealed to a key we cannot open — denied sections never decrypt.
Create a Capsule · seal a documentPOST /api/v1/capsules · …/documents
Add a memberPOST …/capsules/{id}/members
Grant an AI · the agent reads…/ai-grants · …/ai-read
Pull a proof · revoke (crypto-shred)…/audit · …/revoke
See usage & billingGET /api/v1/usage/invoice