Yes. Each company’s data is kept separate by workspace, and the workspace is taken from the signed-in session (or the API key) on every request, never from something the caller types in. A request made for one workspace cannot see or change another workspace’s data, even if someone guesses or tries record numbers.
Think of an office building with locked floors. Everyone shares the lifts, but your key card decides which floor the doors open on, and nobody gets to choose the floor by writing it on a form.
What counts as “your workspace”?
A workspace is your company’s account on Wetel (the API calls it a tenant). Every user account belongs to exactly one workspace, and the people in it set up and supervise the AI employees that work there. A workspace holds:
- your AI employees (agents) and their workflows
- conversations (sessions)
- knowledge bases and the documents in them
- tools and connections to your systems
- users and API keys
How is the workspace decided on each request?
It comes from the credential, in three forms:
- People signing in to the dashboard get a login token that lasts about a day. The workspace comes from that token. Changing or deleting workspace settings takes no workspace number at all; it always applies to your own.
- Your systems use an API key. A key belongs to the workspace of the person who created it and can only start conversations with that workspace’s AI employees. The key is shown once, and Wetel stores only a fingerprint (a hash) of it. Named keys can each be revoked on their own, and revocation takes effect on the next request.
- A conversation in a browser gets a token that lasts about an hour and works for that one conversation only.
Who at Wetel can see anything?
Here is what our documentation states today:
- When your systems run a task through the API, or a schedule fires, Wetel keeps a record so support can answer “what fired, and what happened?” It holds the names of the inputs sent, never their values, and Wetel support staff can see it.
- A Wetel administrator can restrict which AI models your workspace, or one of your API keys, may use. This is set on request.
- Inside your workspace, each person can see a log of their own changes. A workspace-wide view for customers is not built yet.
What is not in place yet?
- No third-party security certification yet.
- No dedicated database option. Workspaces share the platform and are kept apart on every request.
- No choice of region for where your data is stored.
What should you ask any vendor?
Ask us these too:
- Where does the workspace on each request come from: the login or key, or something the caller sends?
- Can I revoke one key without breaking every other integration, and do you store the raw key?
- Who on your side can see our data or history, and exactly what do they see?
- Is separation per request or per database, and is a dedicated option available today or only planned?
- Which certifications do you hold today, and where is our data stored?
If an answer is “it’s on the roadmap,” treat it as not available today, and plan around that.
Related reference docs
- Multi-tenancy: the one-workspace-per-customer model and how API keys are scoped
- Authentication: the three credentials, named keys and how revocation works
- Tenant API:
myAuditLogs: what the personal change log records and what it does not - Knowledge Base (RAG): knowledge bases are scoped to your workspace
If you are weighing this up for real work, tell us which work you’d hand over first and we will tell you plainly which parts are live today.