Security by boundary, not assumption.

Toki is designed around a simple rule: a meeting record must not silently widen the audience that could access the original conversation.

• Tenant isolation: workspace-scoped repositories and forced PostgreSQL row-level security constrain durable records.
• Explicit lifecycle: an authorized host starts capture manually and a visible Discord notice precedes transcription.
• Separate decisions: requester reading, destination disclosure, and external-action authority are independent.

Discord OAuth binds an installation to one Discord server and one Toki workspace. The installer needs Discord server-management permission and an active pilot entitlement.

Discord identity attributes speech and requests. It does not let a person approve consequential work by voice alone. Current roles and explicit Toki capability grants remain authoritative.

Raw Discord meeting audio is processed transiently and is not stored. Bounded per-speaker PCM frames pass to the configured speech provider and are discarded.

Final transcript utterances retain meeting identity, Discord speaker attribution, timestamps, confidence, and provider metadata. Storage failures interrupt capture rather than allowing an apparently successful but incomplete record.

• Secrets stay in server-side configuration and outside browser assets.
• OAuth state, callback input, installation entitlement, and Discord guild authority are validated.
• Request IDs and content-minimized audit events support incident investigation.
• Retries and state transitions are deterministic around provider calls.
• Application health separately reports PostgreSQL, Redis, and Qdrant readiness.

Toki is in a controlled private beta. Meeting capture remains disabled by default and requires both a global activation switch and an exact workspace allowlist.

Cited summaries, company-knowledge retrieval, web research, GitHub read access, and approved GitHub issue creation are roadmap capabilities—not claims about the currently activated capture service.

Use the private support channel supplied by the person operating your Toki pilot. Include the affected workspace, request ID when available, reproduction steps, impact, and a safe way to contact you.

Do not access another workspace’s data, degrade the service, or publish an unresolved issue.