Unlimited Nodes
No artificial limits on workflow complexity. Build as big as your process demands.
HelloDave is a complete platform: visual workflow builder, AI agents, human review, API integrations, enterprise security, and full audit compliance. No bolt-ons. No third-party middleware. No missing pieces.
Join the WaitlistDave's core features are a visual drag-and-drop workflow builder with unlimited nodes, model-agnostic AI agents across 7 provider types, human-in-the-loop tasks and approvals, 305 REST API endpoints with webhooks, per-tenant encryption, and full SOC 2/GDPR audit logging. It all runs on fully managed hosting, live the same day.
Yes. Every feature is available through a REST API of 305 endpoints, authenticated by JWT or API key. Workflows can also call any external REST API mid-flow through an API Call node, and inbound webhooks connect Dave to the rest of your stack with no middleware required.
Build any process. No limits on complexity.
No artificial limits on workflow complexity. Build as big as your process demands.
Edges carry conditions evaluated at runtime. Flows can branch, merge, and loop based on field values, vote outcomes, or custom criteria.
Workflows can loop back to earlier steps (reject and rework cycles, iterative refinement) with safety bounds to prevent runaway execution.
Every save is a new version. Previous versions are retained for rollback and audit. Running instances always use the current version automatically.
Before a workflow goes live, the engine validates graph integrity, node configuration, field assignments, and agent assignments, with specific, actionable error reporting.
Guide: Make it activeThe activation validation above, in practice: a draft workflow refuses to go live and names every node that is missing an ideal path, then the graph is assembled node by node.
Recurring runs are not a cron line buried in config. Each one is an object with an owner, a cadence and a next run, and it can be edited, paused or deleted without touching the workflow.
Fields decide what a workflow collects, and every later node reads the same values.
AI as a first-class participant, not an afterthought.
OpenAI, Anthropic, Azure OpenAI, Google AI, OpenAI-compatible, local (Ollama), and custom endpoints. Your keys, your models, your choice.
Guide: Add a providerTrack prompt and configuration changes over time. Roll back to a previous agent version without disrupting active workflows.
Guide: Create an agentBuild a library of reusable prompts with AI-assisted creation, organized by category: content generation, review, safety, analysis, transformation, custom. Lock a prompt to an agent and every workflow using it is forced onto the locked version.
Upload reference documents or attach URLs to give agents the context they need. Files are encrypted at rest with per-tenant keys.
Each agent node supports 1–10 retries. On exhaustion, the engine creates a human intervention node: no workflow is ever silently lost.
Agents maintain memory at the instance level. When reused later in a workflow, they recall previous outputs: no context lost between steps.
Connect anything. No middleware required.
GET, POST, PUT, PATCH, or DELETE. Supports field interpolation in URLs, headers, and request bodies: inject live workflow data into every call. Configurable 1–10 retries with a 30-second timeout per attempt.
Map values from API responses back into workflow fields using dot notation. Data from external systems flows directly into your next node.
Select stored credentials from the vault: bearer tokens, API keys, basic auth. The engine resolves and applies them at runtime. Raw keys never appear in your workflow config.
Subscribe to real-time events as they happen: instance started, task assigned, workflow completed. Secret signing, automatic retry, delivery tracking, and manual retry all included.
Every feature in HelloDave is accessible programmatically. Trigger workflows, manage users, query audit logs, control tenants: all of it via REST API with JWT or API key auth.
Point the AI assistant you already use straight at your workspace.
Assistants connect over HTTPS to your own workspace address using the MCP Streamable HTTP transport. There is no local process to run, no npx, and no Node.js install. Dave generates the config for Claude Code, Claude Desktop, VS Code, and JetBrains.
Guide: Connect over MCPAn assistant can list and build workflows, start and steer instances, work tasks, and query agents through 34 tools. Every request carries the caller's own key and is limited to the capabilities that registration was granted.
Observer is read-only. Operator runs workflows and completes tasks. Builder edits workflows and agents. Full grants every capability. No preset hands out an admin wildcard.
Actions taken through an integration are recorded alongside actions taken by people, attributed to the integration by name, so an assistant is as accountable as a colleague.
One platform. Many organisations. Complete isolation.
Every database query is scoped by tenant ID. Users in one tenant cannot see, modify, or even know about another tenant's data.
Each tenant gets its own subdomain. Nginx is automatically reconfigured when tenants are activated or deactivated: no manual server work required.
AI credentials and uploaded files are encrypted with per-tenant keys derived from a master secret. One tenant's credentials are cryptographically inaccessible to another.
Each tenant can set their own application name, logos, favicon, and full colour theme (light and dark mode). No shared UI state between tenants.
Enable or disable features per tenant. Roll out new capabilities gradually or limit access to specific organisations.
Tenant Settings in a second demonstration workspace. Name, application title, logos and the whole colour theme are set per tenant, which is why this one looks nothing like the captures further up the page.
Locked down at every layer.
One-command hardening script applies CIS/NIST-aligned controls across SSH, kernel, firewall, intrusion prevention, auto-patching, filesystem, and audit configuration.
API keys and secrets are encrypted with AES-256-GCM before hitting the database. Encrypted values are never returned via the API: once stored, a secret can only be used, not read back.
Configure compliance standards per tenant. SOC 2 adds read-access logging and CC6/CC7/CC8 coverage. GDPR adds data subject access tracking and Articles 5/15/17/30/33 support.
OAuth2/OIDC with Google, Microsoft, GitHub, Okta, and custom providers. Eight MFA provider types with configurable enforcement, grace periods, and trusted devices.
20+ permission types enforced at both API and frontend level, across six tenant-scoped built-in roles (Admin, Create, Curate, Use, Reporting, and Financial) so each person only sees what their role needs.
See the full role breakdownEvery data mutation, authentication event, and configuration change is captured automatically. Filterable by date, action type, entity, and user. Exportable as CSV.
Zero to production in minutes. Fully managed.
No infrastructure to provision. Log in and start building. Most teams run their first workflow the same day.
Platform updates, SSL certificates, and backups are handled for you: nothing to patch or maintain.
Every tenant gets a dedicated subdomain, fully isolated from every other tenant on the platform.
Every recorded action carries a timestamp, the event type, the actor's email address and user ID, the entity affected, the HTTP method, path and status code, the source IP address, the user agent, and the request body with passwords, secrets and tokens redacted. You can search the log by text and filter it by event type, entity type and date range, then export exactly what you filtered as CSV. By default only changes are recorded; switching on SOC 2 or GDPR mode adds read-access logging for users, roles, secrets, API clients, OAuth providers and reports.
You decide, per workspace, across three separate settings. Completed instances and their artifacts are kept for 90 days by default and audit logs for 365, and each can be set to 30, 60, 90, 180, 365 or 730 days, or kept forever. Cleanup runs on a schedule and deletes expired records permanently, so export anything you need before its retention period lapses. With SOC 2 mode switched on, Dave warns you when audit retention sits below the seven years that standard recommends.
The two answers above as screens, both of them settings a workspace administrator can reach without opening a support ticket.
The whole of the above in one list, if you would rather scan than read.
| Feature | Detail |
|---|---|
| Visual workflow builder | Drag-and-drop canvas, 10 node types, branching, loops, versioning |
| AI agents | 7 provider types, versioned configs, prompt library, retry logic, agent memory |
| Human-in-the-loop | Review nodes, user interaction, role-based task assignment |
| API Call nodes | Any REST endpoint, response mapping, credential vault, retry |
| Webhooks | Event subscriptions, delivery tracking, secret signing, auto-retry |
| 305 API endpoints | Full programmatic control over every platform feature |
| Multi-tenant | Complete data isolation, subdomain routing, per-tenant encryption |
| Security hardening | 18-step automated hardening, AES-256 vault, RBAC, Fail2Ban |
| SSO and MFA | Google, Microsoft, GitHub, Okta, Custom OIDC (8 MFA provider types) |
| Audit compliance | Standard, SOC 2, and GDPR modes with compliance tagging |
| Branding | Per-tenant name, logos, favicon, and full colour theming |
| Deployment | Fully managed: live the same day, zero infrastructure |
Dave is model-agnostic across 7 provider types: OpenAI, Anthropic, Azure OpenAI, Google AI, OpenAI-compatible, local (including self-hosted Ollama), and custom endpoints. You can choose a different provider per agent.
Credentials are stored in a per-tenant vault, encrypted with AES-256 before they reach the database, and never returned through the API once saved.
Yes. Tenants can configure OAuth2/OIDC single sign-on with Google, Microsoft, GitHub, Okta, or a custom provider, alongside email and password login.
Yes. An API Call node can call any REST endpoint mid-workflow with credential vault integration and response mapping, and Dave supports webhooks for event-driven integration.
Yes. Every data mutation, authentication event, and configuration change is captured automatically, filterable by date, action type, entity, and user, with SOC 2 and GDPR compliance modes and CSV export.
Yes. Each tenant can set its own application name, logos, favicon, and full color theme for light and dark mode, with no shared UI state between tenants.
You can define your own. Dave seeds six built-in tenant roles as a starting point, Admin, Create, Curate, Use, Reporting and Financial, and roles are defined per workspace, so an administrator can compose new ones from the same fine-grained permissions. One person can hold more than one role at a time.
Deactivate them rather than deleting them. An inactive user cannot sign in, any session they still hold is invalidated on its next API call, the seat they occupied is freed for someone else, and the audit trail of everything they did stays intact.
Sixty minutes of idle time by default. A workspace can set anything from 5 to 1,440 minutes, or switch the timeout off entirely. Sessions use tenant-scoped JSON Web Tokens with refresh-token rotation, so every refresh invalidates the token that produced it and a token issued for one workspace cannot be replayed against another.
The fastest way to understand what HelloDave.ai can do is to run a workflow inside it. Get in touch and we'll walk you through it.