Isolation
Your own server. No shared processes, no shared vault, no shared keys, no other customer's data on the same box. We do not run a multi-tenant platform, so there is no cross-tenant boundary to get wrong.
The security story is short, which is the point.
One customer, one server, one vault, one set of credentials. Never multi-tenant. Most of what follows falls out of that single decision, and it is simple enough to explain to your IT lead without a diagram.
How your install is separated from everyone else's
Prophet 21 access
Reads use a read-only login. Guarded writes use a Transaction API user with the minimum roles required. The network path is your VPN or an allow-list to one static IP — and if you won't expose SQL at all, we run a small on-premise relay instead.
Secrets
Credentials live in one root-only file on your server, never in a repository, and are rotated when you offboard. The agents are instructed never to echo a credential into chat, the vault, or a log — and the scripts that would carry one refuse to.
Writes
Only verified recipes. The healer never brute-forces. Forbidden actions — raising a credit limit, deleting data, spending money — are blocked in the agent's rules and refused by the code that would have to perform them.
Audit
An append-only log in your vault plus a machine log on the box. Every guarded action records what was done and who approved it. The log is in your repository, so we cannot quietly edit your history.
Backups
Your memory lives in your own GitHub repository by design — that is the backup, and you hold it. The server itself is snapshotted nightly.
Your agent's memory is yours, in a format you can read
This is deliberate and it is unusual. Most AI products keep what they learn about you inside their own database, which means leaving costs you everything the system knew.
- The vault is a private GitHub repository in your account
- Its contents are plain markdown — open it in Obsidian, or any text editor
- You can read exactly what the agent believes about your business, and correct it
- Ingested source material stays read-only; the agent's own notes are separate
- If you cancel, you keep the repository. There is nothing to export
If MeshCore disappeared tomorrow, you would still have every note your agent wrote, in a format you can read without us, in a repository you control.
The questions we actually get asked
Where does our data go?
Your Prophet 21 database stays in your network. The agent queries it and works with what comes back. To reason about that data, the agent sends the relevant parts to a large language model provider under our API terms — we state this plainly in the agreement rather than burying it, and if your IT team needs a no-training or enterprise endpoint arrangement, ask on the call.
Can the agent delete something?
No. Destructive changes are a forbidden class: not gated, not approval-required — refused. The agent can propose a correction and show you what it would change, but the deletion path does not exist for it.
What if it gets a Prophet 21 write wrong?
Guarded writes run only through recipes verified live against a real install, and they read the record back to confirm what actually happened. When a write fails, the healer retries known-good fixes and stops — reporting to a person — on anything that should stop. Every attempt is in the audit log.
We won't expose SQL Server to the internet.
Good. Most of our customers say the same. The options are a VPN, an IP allow-list to your server's single static address, or a small on-premise relay that makes the connection outbound from inside your network.
Who approves a write?
You name that person at discovery, and it is recorded per action class. Pending guarded items appear in the daily brief and in the console until somebody acts on them.
What happens if we cancel?
You keep the vault repository — it is already yours. We revoke keys and destroy the server. There is no exit project and no data extraction, because nothing of yours was ever only in our custody.
Do you work for Epicor?
No. MeshCore works with Prophet 21; Mesh Connector is not an Epicor partner and does not claim to be. MeshCore contains no Epicor confidential material, and it neither grants nor replaces a Prophet 21 licence — you need your own.
Can we use our own model provider key?
Ask on the call. Some IT teams insist, and it is a reasonable thing to insist on.
Bring your security team to the call.
We would rather answer the hard questions before you buy than discover a blocker in week three. If something here doesn't clear your bar, tell us — a few of these controls exist because a previous customer pushed back.