The questions that come up before a firm will put client work into a new tool. Where something isn’t settled yet, this page says so rather than implying otherwise.
Everything belongs to an organisation, and every request is scoped to it. There are exactly two ways for anything to leave that boundary: you invite a named person by email, or you publish a link deliberately.
A project can never be made public as a whole. You publish individual frames you choose, or one lane — a single row of the project — as a presentation, and nothing else. Every sharing state is shown as a written label rather than a colour you have to interpret, and every share can be revoked.
Yes, in full, as plain markdown. The wiki, the skill library and whole projects all export as Open Knowledge Format bundles, an open interchange format rather than a Drafted one.
This is deliberate. The knowledge your firm builds up is the asset; a tool that holds it hostage isn’t one you should put it in.
The narrowest scope Google offers for this: drive.file. Drafted can only ever see files it created itself. It can’t read the rest of your Drive, and the consent screen you see says exactly that.
The trade-off is real and we chose it deliberately: a file someone drops into the folder by hand won’t sync, because we would rather not be able to read your Drive at all.
The same place liability sits when a principal signs a graduate’s draft. Drafted drafts; a qualified human reviews and signs. The agent isn’t a signatory.
What Drafted adds is that the standard the work was held to is written down, versioned, and enforced before the draft exists, which makes reviewing it properly easier rather than harder.
Frames render sandboxed and cross-origin, so content produced by an agent can’t reach your session. Interactive app frames are additionally restricted by content security policy and are never given same-origin access.
Flags that grant a frame extra privilege are server-controlled only. Nothing an agent or a browser client sends can promote its own content.
The application and its database run in the EU, on hosting in Nuremberg, Germany.
On formal certifications, data-processing agreements and provider retention terms: these aren’t published yet, and we aren’t going to imply otherwise on a marketing page. If your procurement needs them in writing, ask us and we’ll answer specifically.
Start a project and put a real piece of work through it. That answers most of them faster than we can.