What admins can see

Four kinds of people have some view into your workspace: other members, workspace owners and admins, viewers of your links, and Fermium's operators.

Other members of your workspace

A member sees files they own or have explicit access to through a document, folder, group or shared-space grant. Workspace membership and listing: team do not grant access. Restricted and legacy workspace links require sign-in plus current permission. Individual and whole-workspace grants work on every plan; group grants require Team or above.

Unlisted links and password-protected links are deliberate external publication choices: holders may open them under those visibility rules. Publishing a link does not give its visitors access to analytics, answers in a separate database, or other files. Members can edit only where they hold edit permission; changing sharing requires management rights.

Every member can read the members list: email addresses, roles, join date, last sign-in, and whether an account uses SSO or was provisioned. Every member can change workspace-level settings: name, viewer domains, custom domains and billing; those are not role-restricted today. Every member can read the workspace policy.

Workspace owners and admins

Owners and admins additionally see and control what the workspace does as a whole:

• The audit log (Business and above): every publish, update, edit, deletion, visibility, retention and access change, legacy gated views subject to the file's activity permissions and retention, every sign-in with method and IP, every token minted or revoked, every membership and group change, policy and webhook changes, and account exports and deletion requests. Members see only the events about their own documents. See Audit log.
• Access on any document: they can share and unshare any document in the workspace and read its access list.
• Legal hold on any document, and its hold and expiry state (Enterprise).
• Policy, webhooks, SSO and SCIM configuration, and the webhook deliveries log with the response codes your endpoint returned.

They do not get a document browser for other people's unshared documents, and the audit log records a document's title, folder and visibility, never its content.

Viewers of a link

Anyone who opens a document sees its content and the title, description and any metadata you put in it. They do not see your email, your tags, your other documents or the version history. A reader of the wiki additionally sees the navigation, the version number and how long ago the page was last edited, and the titles of other wiki pages that link to it; the wiki only ever shows documents inside a published folder or reached by an agent-tree wiki's navigation, and applies each document's visibility as a direct link would. The Activity panel separates audience traffic from internal previews and detected bots. Verified accounts in the document's workspace may be named when a viewer identity is available; unrelated public visitors remain anonymous to that workspace. Editors see totals; owners and sharing managers with edit access can see retained details and optionally reveal IPs. Merely viewing a link gives no analytics access.

Fermium operators

A small, fixed set of operator accounts have an Admin area in the app. It exposes:

• the list of workspaces with slug, name, plan, plan source, member count and storage used;
• the ability to set a plan without Stripe, pre-create a company workspace and claim its viewer domains, move a user between workspaces, and disable an account;
• tooling for handling support requests.

Operator actions on your workspace (admin.plan_set, admin.user_moved, admin.user_disabled, admin.workspace_created) are written to the same audit log you can read.

Operators do not have a document browser for other people's workspaces in the app. As the people who run the infrastructure they can technically reach storage and the database for incident response, a requested restore, an abuse report or a legal request. This operational access is distinct from automated features processing content at your direction, including the local-review hosted Agent features below. See the Privacy Policy for the service's commitments.

Hosted Agent sessions

For the local-review hosted Agent features, managing an Agent or its credit settings does not itself grant access to other people's private conversations. A shared session still requires its explicit grant and the applicable Agent/source access. Submitting a memory proposal lets eligible reviewers read that proposed document, not its whole private source conversation. Auditor access likewise does not expose linked credentials or another person's private tool result. See Agent chat.

Workspace owners, admins and auditors can view aggregate hosted credit usage by Agent and requester under Settings → AI credits. This billing view does not include prompts, transcript text, session titles or document titles, and does not grant additional Agent access. Website visitor usage is reported separately from a member's own requests. Financial totals remain after conversations or Agents are deleted; unavailable attribution is labeled instead of removing the charge.

What is never visible to anyone

• Document passwords and Fermium-issued static, access, refresh and SCIM tokens are stored only as hashes. Not even operators can recover them.
• Linked MCP access/refresh tokens and custom credentials are encrypted for server-side use. They are not returned through Agent tools or connection APIs.
• The client secret of your identity provider is stored encrypted and never returned by any API.
• A webhook secret is returned once, at creation.
• Secret scanning records the file and the category of what it found, never the value.
• Your Google password is never seen by Fermium.
• Card numbers stay with Stripe.

What you can audit yourself

• Settings, then API keys and tokens lists every token on your account, including those the OAuth flow created for each client and machine, with creation, expiry and last-used times.
• Every document shows its version number and updated time in the inspector; list_versions shows the whole history with what wrote each version.
• Every tool response an agent gets includes the document's full settings, so an agent's transcript is a record of what it did.
• On Business and above, the audit log and its CSV export are the authoritative record; members can read the events about their own documents even without the admin role.