Building Trebellar: the engineering principles behind a governed AI platform
A look inside how we build: tenant isolation by default, every model call auditable, and no answer without a source. The principles that shape every release.
David Garcia Quintas · Co-founder, CTO
On this page4 sections
We started Trebellar as a side project between two engineers who had spent their careers building large-scale systems at Salesforce, Google, and Waymo. The habits from those years shaped what the platform became. This post lays out the principles we hold every release to.
Isolation is not a tier
Every customer’s data is isolated at the infrastructure level, not by a flag in a shared database. There is no configuration that could let one tenant see another. This costs us some efficiency and buys our customers a conversation with their security team that ends quickly.
No answer without a source
Any number the platform shows – in a dashboard, an agent’s draft, an Explorer score – can be traced to the source rows and the transformation that produced it. If we cannot show the provenance, we do not show the number.
Models are governed like data
Which model handled a request, with what prompt, over what context, producing what output, is logged and reviewable. Model changes go through the same review as schema changes. An AI platform for enterprise real estate has to be auditable in the same way the financials are.
Boring where it counts
- Schemas are versioned and reviewed like code.
- Every integration is idempotent; a rerun never double-counts.
- Failures are loud. A source that stops updating raises an alert before anyone reads a stale number.
The interesting work is in the agents. The trustworthy work is in everything underneath them.
If these principles sound like the way you want to build, we are hiring.
