OpenAI → Pinecone → Clerk

Architecture

1. 01clerkorg_id / user_id scopes every write and query
2. 02openaiembeddings generated server-side only
3. 03pineconenamespace = tenant id; never shared

Env-var matrix

Security checklist

• namespace pinecone by clerk org_idcross-tenant retrieval is a data breach
• never embed from the browser with the secret keykey exfil is permanent
• authorize before query, not afterfiltering results post-hoc still leaks counts

Folders

· src/ai/embed.ts
· src/ai/query.ts
· src/lib/tenant.ts