Trust is part of the system, not an appendix.
Least access, explicit ownership, observable behavior, and evidence a security or governance team can inspect.
Consent once, revoke any time
Aristo uses one read-only consent for Microsoft reporting signals — usage, departments for grouping, and seats bought against seats assigned. Anything that writes, such as moving one idle seat on a leader’s approval, stays off until your admin consents to it. Placemark uses one app-only application permission for Places, plus the Exchange roles Microsoft requires, granted by a script your admin runs. Both are revocable in the admin center.
Teams of five or more, never a ranking
Leaders see teams of five or more people — never a per-person activity view, and no ranking of people anywhere.
The one exception is the named department view, which your organization turns on under its own named-data agreement: department heads then see who their champions and AI users are — a name and a group, never a personal activity record, prompts, documents or a ranking. The five-person floor still applies, and a person’s “do not name me” choice is always honored.
No mailbox is read until your admin’s Exchange policy allows it and the person asks Aristo to watch their inbox. Content is used only to produce the result, then dropped — never used to train a model. The product covenant documents the boundary in public.
Built where the enterprise operates
Systems are designed around your Microsoft data, identity and governance boundary. Custom builds run in your Azure subscription; cost is read from your own Cost Management export.
Evaluation ships with the system
Production AI needs observable behavior, testable quality and a clear escalation path. We treat evaluation and telemetry as architecture. Review the Aristo covenant and the product trust surface.
What it does and does not do
No advertising or tracking cookies. Forms are protected by a bot check and validated at the edge; we keep only what you type into them. See the privacy policy.