| Organization / Tenant | Top-level account boundary for billing and isolation — Multi-tenant AI Architecture, Organizations |
| AI Workspace | Isolated knowledge + tools + conversations — What is an AI Workspace? |
| Customer AI | Website widget and/or WhatsApp assistants — Customer AI vs Employee AI, Customer AI |
| Employee AI | Internal Portal assistants for org members — Employee AI |
| Internal Portal | your-company.qefro.com employee experience — Internal Portal |
| Knowledge Platform | Ingest + hybrid retrieval + citations — AI Knowledge Platform |
| Hybrid RAG | Lexical + vector retrieval for grounded answers — Hybrid RAG |
| Business Tool | Workspace connector (rest / OpenAPI or sdk) the AI can invoke — Business Tools, Register SDK Business Tools |
| Business Action | Runtime invocation of a Business Tool — What are Business Actions? |
| Business Flow | Declarative orchestration of tools/steps executed by FlowRunner — Define Business Flows, Run Business Flows |
| Flow trigger | Entry path for a flow: conversation (intent), event, schedule, or webhook — Event-Driven Triggers |
| Orchestration event | Namespaced bus envelope that can start event-triggered flows; connectors only emit — Event-Driven Triggers |
| Marketplace App | Metadata package (hosting: runtime) executed by Qefro Runtime — Build your first app, Runtime vs SDK |
| SDK Connection | Signed org webhook for @qefro-ai/backend / qefro-backend-sdk connecting external systems — Register SDK Business Tools |
| Identity Forwarding | identify() end-user JWT/session into tool calls — Identity Forwarding |
| Widget token | Publishable embed key for cdn.qefro.com/widget.js — Website Widget |
| Owner / Admin / Member | Organization RBAC roles — RBAC |
| Team | Grants Members access to workspaces — Teams |
| Custom domain | Your hostname for the Internal Portal — Custom Domains |
| AI Agent Security | Controls for retrieval + tool calling — AI Agent Security |
HMAC /qefro | Platform → app invoke authentication (X-Qefro-Signature) — Authentication, Application security |
| AES-256-GCM secrets | Application-level encryption for tool/SDK/channel credentials — Encryption |
| Customer Access Service | Organization-owned evaluate/challenge API; Qefro is not a customer IdP — Identity & Authentication |