Pinolo — spec sheet
The chief of staff that shows you its wiring.
Your AI does the thinking, on your subscription. Our server keeps the memory — row-level isolated, append-only, holding as few keys as the job allows. Here is the diagram, and the guarantees — structural, and tested on every commit.
The work loop: your assistant claims a job under a lease, loads a skill, reasons, writes back a schema-validated result. The server orchestrates everything and understands nothing.
Five guarantees, all structural.
Zero LLM on the server
The server orchestrates — state, queue, scheduling, delivery, audit — and understands nothing. Every act of reasoning happens in your own assistant, connected over MCP. A server that cannot think is a server that cannot be prompt-injected out of its promises.
the runtime executes no model call; reasoning is structurally at the edge
Tenant isolation the database enforces
Row-level security with FORCE on every tenant table; the tenant is set per transaction, never per connection. Every reference between tenant tables is composite — (tenant_id, id) — because foreign-key checks bypass RLS. A cross-tenant reference is not forbidden; it is unexpressible.
cross-tenant isolation tests run on every commit, not once a quarter
The token is the only tenant source
Tenant identity comes from the authenticated session or token — never from a URL, a header, or a parameter. A client cannot ask for a tenant. It can only be one. Runtime database roles hold minimum privilege, cannot bypass RLS, and a forgotten role switch fails closed: the request errors instead of running with too much power.
no read or write path accepts a tenant id as input
Append-only memory, provenance to the field
Evidence is immutable by the database — update and delete revoked, triggers rejecting any attempt. Beliefs are superseded, never edited. Every entity field traces to the assertions that support it: ask a commitment why it exists and the answer is a chain — this field, from that assertion, from that meeting, on that day.
immutability is a constraint that refuses, not a comment that asks
Credential custody, minimized
No connector vault. Push lanes authenticate with per-tenant tokens stored only as hashes. Your assistant reads your tools with credentials Pinolo never sees. The one narrow exception — transcript services that only offer polling — is per-tenant envelope-encrypted with tenant and provider bound into the cipher’s authenticated data, entered only through the web portal, and never readable back through any tool, API, or log.
a secret pasted into a conversation lives in that history forever — so none ever is