Skip to content

Trust and control

Move fast when it’s safe.
Stop when it isn’t.

Netrix works with live sites, agency credentials, and client data. That calls for clear limits: exact permissions, human approval, independent checks, and a way back when something goes wrong.

Tenant-scoped access Encrypted credentials Explicit approval Reversal status
NetrixDecision boundary
ReviewPerson decides
TargetExact identity
VerifyRead it back
RevertKnown prior value
Netrix at the center of four controls: human review, exact targeting, live verification, and recovery.

Where the safeguards live

Security is easier to trust when you can see the actual controls.

“Secure” is too broad to be useful on its own. Here’s what Netrix enforces at each important boundary.

01

Workspace boundary

Who can read or act

IDENTITY
Account data
Scoped through the current membership
Client access
Limited to explicitly granted businesses
Ownership
The last owner cannot be removed or demoted
02

Credential boundary

What a connector may use

SECRETS
At rest
Integration credentials are encrypted
At render
Stored secrets remain write-only in the UI
At use
Provider and account scope travel together
03

Network boundary

Where the server may reach

EGRESS
Addresses
Private and metadata targets are refused
Redirects
Every hop is validated again
Requests
Time and response-size budgets are bounded
04

Write boundary

What changes on a site

DELIVERY
Approval
Accepted work is distinct from a draft
Target
The page element carries an exact identity
Outcome
Applied, verified, failed, and reverted stay distinct

Before, during, and after deployment

A safe change takes more than a Deploy button.

Each step answers a different question. If one fails, Netrix doesn’t quietly label the whole job a success.

  1. 01

    Resolve

    Name the page and exact element the finding belongs to.

    Stops on ambiguity
  2. 02

    Authorize

    Check the acting membership, review state, connector, and site.

    Stops on scope
  3. 03

    Apply

    Write through the active connector and retain the prior value.

    Records the attempt
  4. 04

    Verify

    Fetch the live page and compare the action semantically.

    Separate outcome
  5. 05

    Recover

    Revert to the known prior value or release work after a crash.

    Current status retained

What each status really means

The words in the product should match what actually happened.

Netrix drafts.

People approve.

A recommendation stays a recommendation until someone reviews it and asks for the change.

Applied is not verified.

You can see both.

A connector accepting the write does not prove that the live page now shows it.

Sometimes the right answer is no.

Unclear work stops.

Netrix refuses the change when the target, provider, permission, budget, or dependency does not check out.

Things can go wrong.

Recovery is part of the product.

Netrix retains prior values, current status, key timestamps, and write attempts, then provides a controlled path back for supported changes.

How connectors are trusted

Each connection is checked before Netrix uses it.

The WordPress plugin verifies signed requests, rejects replays, and checks its own permissions. Netrix adopts Cloudflare resources only after ownership is recorded. A legacy REST credential keeps the WordPress user’s permissions, but Netrix binds it to one verified site and uses it only to update post titles.

NETRIXPOST /applytimestamp · nonce · body digest · signature
SITE GATE
  • Signature
  • Freshness
  • Permission
LIVE SITEExact targetKnown prior value retained
A signed Netrix request passes through authentication, freshness, and permission checks before reaching an exact live-site target.

Plain answers

Trust questions

Does Netrix make live changes automatically?

No. Netrix finds issues and can draft remedies; a person reviews and accepts the work before a deployment is requested.

Can a client portal user change agency setup?

No. Agency setup, connectors, and audit controls stay with agency staff. Owners and admins can separately allow client AI access and combined deploy/revert access for assigned businesses.

What happens after a connector says a change succeeded?

Netrix records the write as applied, then independently reads the live page. Only that second check can mark the deployment verified.

Can a deployed change be undone?

Supported deployments retain the prior value and show their current reversal status. Connector safeguards differ: the WordPress plugin and Cloudflare paths refuse stale work, while Legacy REST reversals can overwrite newer edits and should be reviewed before use.

See it in the workflow

Good controls protect the work without slowing down the team.

Back to the product