Security & privacy
Operational data is the most sensitive asset an organization has. So it never leaves.
This page was written for the person responsible for information security who wants direct answers. Every item here is a commitment, not an aspiration.
What we commit to
Installed on your side
An on-premise server or a private cloud, inside your network. It works without an internet connection.
Zero outbound traffic
No telemetry, no usage reporting, no calls to external services. The only exception: your written approval, for a defined destination and a defined purpose.
Local models
The language models run on your hardware. No question, no data and no answer is sent to an external provider. The model can be swapped; the principle stays.
Read-only
The system reads data. It never writes, changes or deletes anything in your source systems. During the pilot it does not connect to systems at all, only to the files you provide.
The model never touches the database
The language model has no direct access to the data and runs no queries by itself. Every query is validated against what was defined in advance and executed with read-only permission.
Permissions by role and department
Enforced in the database, not on screen. A user sees only what was defined for them. The system is built for a small group of managers, and users are managed inside it.
Audit log
Every administrative action is recorded. Irreversible actions require double confirmation.
It does not invent
When there is not enough data for an answer, it says so and names what is missing. A confident wrong answer is exactly the risk the system was built to prevent.
At the end: deletion
When a pilot or an engagement ends, the server is wiped with all the data that was on it.
Mutual NDA
Signed before every pilot. The system is built from software components under full commercial licenses, and can be installed air-gapped, without internet access.
What the system does not do
Privacy and regulation
The data never passes to a third party and never leaves the organization's control. That is why this architecture makes compliance with privacy and data-security regulations simpler: the data stays with its owner, under its control, with no chain of sub-processors and no cross-border transfer.
A detailed security and architecture brief is available in a meeting, under NDA. Have a security questionnaire? We will gladly complete it.
A question this page did not answer?
We will gladly answer it in a meeting, together with whoever is responsible for information security on your side.