Every AI product says "trust us." RowFold's answer is different: don't. Check. Every figure the AI states is re-run against your live data before you see it, the working is one click away, everything it creates is logged under its own name, and one click walks it back. This page lists the guarantees — each one checkable in the product today.
When the AI states a figure, it doesn't get to do its own arithmetic. It declares the claim, and RowFold re-executes the underlying query against your live data server-side. The badge on the answer isn't decoration — it opens into the exact check that ran and what came back.
| Step | What happens | What you can inspect |
|---|---|---|
| The AI answers | "Your open deals total £248,400 across 31 records." | Every record it names is a clickable citation to the real record. |
| RowFold re-checks | The sum is re-run as a live aggregate over the Deals table — server-side, not the model's own arithmetic. | The receipt: the exact query replayed, and the number it returned. |
| The check holds — or it doesn't | A match gets the verified badge. A mismatch is said in the answer, not hidden. | The workspace tally counts both: checks run, checks held, checks that didn't. |
| Charts get the same treatment | Any chart under an answer is recomputed server-side from the aggregate it names — never drawn from what the model wrote. | The chart's data source, same receipt trail. |
The AI runs under your permissions. A field hidden from you never enters AI context — not in answers, not in summaries, not in search. The Ask page lists exactly which fields are hidden from the AI for you, by name, so the guarantee is readable, not asserted.
RowFold is an MCP server, so Claude Code, Claude Desktop or Cursor can work your workspace directly. A connection is bound to one member and sees exactly what that person sees: hidden fields stay hidden, no-access tables stay invisible, and there is no separate integration-permissions model to configure or get wrong. Writes are off until you allow them, and land in the audit log as MCP · connection (as person).
Everything the AI creates or changes appears in the audit log as its own actor — AI · Ask (for you) — exactly like API · token and Automation · name. "Who changed this?" has one consistent answer, and an AI write is never dressed up as a human one.
Records the AI creates come with an Undo on the confirmation — they move to the Trash, restorable like anything else. Schema changes are confirm-to-apply before they happen: the AI proposes, you approve, nothing lands silently.
Ask answers from your records, never from recall — and when your data can't answer the question, it says exactly what's missing instead of producing a confident number from nowhere. Fair-use limits fail open — a metering hiccup never blocks a paying customer. And when a verification check can't re-run, the receipt says so instead of quietly shrinking the denominator.
An agent that touches your operational data must be able to show its working, sign its changes, and be walked back. Ours can — and you can check all three right now.
Verification · attribution · undoThe verification tally counts failed checks alongside passed ones. A counter that can only report success is marketing; one that can embarrass us is evidence.
Failures included, by designWe tell you plainly what we don't have — see compliance and security. This page holds AI claims to the same standard.
One editorial rule, everywhereNine customers haven't ordered in the last month. Four of them are on Route C.
It's Shannon. Time for some questions. Ask reads your records. Not a summary of them, and not a guess at what they say. Every answer comes back with the number of records it was drawn from, and whether that count is exact.
Here's where these things quietly fall over. Ask what the orders still to go out are worth. Twelve thousand, eight hundred and forty pounds. Drop the condition, and the same question answers a hundred and eighty-six thousand. So the filter has to reach the total, not just the list underneath it.
aggregate_records
group by { "via": "Customer.Route" }
What if the answer lives on another table? A route isn't on an order. It's on the customer the order belongs to. Ask doesn't need you to add a column first. It names the route it wants, walks the link, and groups by what it finds there. So a question that crosses two tables is still one question.
Honestly, answering is the easy half. Ask changes records too. It draws every change as before and after. So you can see the shape of it before you agree to it. Anything your permissions or your approval rules won't allow gets dropped, and it tells you which, and why. A delete goes to the Trash. And there's an undo.
And it doesn't only read. Ask for a report on what you just found, and it proposes one. A saved view. A whole table, with the records already in it. Each one arrives as a card, and nothing is written until you press the button on it. It reads. It changes. It builds. And none of it happens without you.