Client lead operations and founder/team operations stay separated, with raw client payloads kept out of shared operating memory.
Each client can run with its own bot token, data directory, registry record, and deployment mode.
Operational memory records status and aggregate facts, not secret values, payment identities, or raw lead conversations.
What the reference covers
- Sanitized architecture and data-flow boundaries
- Law 25 / PIPEDA control mapping
- Incident-readiness and evidence artifacts
- Publication rules for open-source core material
- Client responsibilities that remain outside the software
Why it matters
Quebec SMBs need AI automation that can be reviewed, explained, and hosted with Canadian data-sovereignty expectations in mind. Trinity gives Velox a practical enterprise conversation: not just features, but controls, evidence, and operating discipline.
Official basis
The Phase WW package references Quebec private-sector privacy law, Commission d'acces a l'information guidance for businesses, and the Office of the Privacy Commissioner of Canada's PIPEDA principles.
Release posture
The public-safe package contains docs, templates, source references, and review checklists. It excludes live credentials, raw client data, OAuth files, backups, logs, and internal customer records.