Docs

Personal vs team objects

When multiple people share an Artifactum vault on Team or Business plans, they need objects that stay private from coworkers as well as objects that are shared across the team. Here is how workspace visibility and isolation work.

Yours: Personal objects

Objects you store in your personal workspace belong to you. Coworkers and their connected AI agents cannot list, search, or get them. When a peer queries the vault, your personal objects look as if they do not exist (fail-closed, returning not-found rather than permission denied so presence is not leaked).

Team: Shared objects

Objects stored in shared or company workspaces are available to anyone on the vault with an active seat assigned to that workspace. Coworkers can search, retrieve, and build on them from any connected AI client (ChatGPT, Cursor, Grok, Claude, or Lens).

What personal objects are not private from

Personal objects provide peer isolation from coworkers, not legal privacy from your employer or from Estes Advisory:

Your company admin: Your tenant administrator / Owner has audited administrative access, matching standard enterprise workplace tools (such as Google Vault, Slack org exports, and Microsoft Purview).
Estes Advisory on Hosted: Because we operate the Hosted infrastructure, Estes Advisory operators can access objects for maintenance, abuse investigation, and support. See our Terms.

If your organization requires a cryptographic boundary where Estes cannot read file bytes, that is our Dedicated tier (isolated AWS account and customer-managed keys) — contact us.

Keys are filing names, not access locks

Logical keys (like owner.category.slug) are naming and filing paths, not security locks. An object is protected because it lives in a restricted workspace boundary, not because its key is hard to guess.

What counts as a seat?