Instant
Someone leaves a group
Their very next question already respects it. We don't store who belongs to which group: your system sends the user's groups with every request, so there is nothing to sync and nothing to go stale.
Security
Nothing leaves your own infrastructure. No third-party AI vendor ever sees your documents
This isn't a policy promise about what a vendor won't do with your data. It's a property of where the software runs. Documents, index and search run in your deployment. The model runs wherever you choose: AWS Bedrock in your own account, Ollama on your own servers, or any other infrastructure that serves it. Below is exactly what goes where, and where permissions are enforced.
Everything below happens on your side of this line
Your own infrastructure, in your region. The application runs in your deployment, and its calls to the model go to the model running in infrastructure you chose. No step in the answer path reaches a third-party AI vendor.
Your infrastructure · your region · your model
-
Your documents
Originals stay in storage you own. No copy leaves your infrastructure.
-
Index & processing
Vector store, document text, OCR, parsing and search run as containers in your deployment. None of it is sent to us.
-
Permissions
Enforced inside the search itself, per user and group, before any passage reaches the model.
-
The model
Runs where you choose: AWS Bedrock in your own account, Ollama on your servers, or other infrastructure you run. It receives authorised passages and the question, and never trains on them.
Storage, processing & inference stay inside this line
Never used for model training · never sent to a third-party AI vendor
Permissions
The model never sees a passage the user can't read.
Permissions are enforced inside the search itself, before anything reaches the model, and then checked a second time. The model is never asked to decide who may see what. By the time it is called, every passage it receives is one this person is allowed to read.
Access is decided per passage, not per folder
Decide who sees what inside each document, independently of where the file is stored. The usual security failure is not an intruder. It is a document holding one sensitive paragraph that stays readable by everyone who needed the other nineteen pages.
Every indexed passage carries the IDs of the groups allowed to read it, set as the document is indexed. The rule is in place the first time anyone asks, and there is no second, redacted copy to keep in sync by hand.
- rule
- pricing & penalty clauses in supplier contracts → Procurement, Legal
- effect
- everyone else gets the answer without those passages
- used for
- confidential contract clauses · HR files · M&A data rooms · board packs
Everyone else
Permissions inherited from folders & source systems.
Provbl
Rules per passage, applied at indexing, enforced inside every search.
Asked by a role without commercial access:
"That's not something your role can see. The Legal & Compliance team can help, or you can request access."
Where authorisation is applied
Four checks, in this order, on every question
-
01
No groups, no search
A user who belongs to no group never reaches the database at all.
-
02
Filtered inside the search
The user's groups travel with the query. The filter runs on each sub-search, semantic and lexical, before results are fused. Nothing is retrieved first and trimmed later.
-
03
Checked again, logged as an incident
After retrieval every passage is checked a second time. A mismatch is dropped and logged. The redundancy is deliberate: a control that lives in one place is one refactor away from being bypassed.
-
04
Tools stay in the same scope
Excel calculation and exact search can only reference sources retrieval has already authorised. Never an arbitrary location.
When access changes
Permission changes don't wait for a sync
One case has nothing to propagate. The other is pushed the moment it happens.
Seconds
A document changes group
Your source system calls a dedicated endpoint that updates only the access on that document's passages. No re-parsing, no re-embedding. Deleting a document removes every one of its passages.
What we don't do yet
Document moves rely on your source system sending that event. There is no reconciliation job today that would catch drift if an event were lost. It is on our roadmap and straightforward to add, and until it ships we won't describe it as existing.
Where the model runs
What reaches the model. And what never does.
Infrastructure · region · retention
Nothing leaves your own infrastructure, and no third-party AI vendor ever sees your documents. Most of the platform never talks to a model at all. The part that does calls the model running in your infrastructure: AWS Bedrock in your own account, Ollama on your servers, or any other infrastructure that serves the model you pick. This is the full split.
Containers on your deployment's infrastructure
Stays in your deployment, no exceptions
- The vector store and all document text
- OCR of scanned pages
- Parsing and chunking
- BM25 lexical search
- Excel recalculation
- Web page reading
Bedrock · Ollama · your choice
Reaches the model, in your infrastructure
- At indexing: passage text, to build the embeddings
- At answer time: the relevant passages and the question, and only passages this person may read
- Sent to: the model running in your infrastructure, nowhere else
Never used for training.
Where inference runs is your choice
AWS Bedrock in your own account
Your cloud · your region · not retained
Everything above stays in your deployment, and the model call stays inside your own account and region. Bedrock does not retain your data or train on it. No third-party AI vendor is in the answer path.
Your cloudOllama or other self-hosted models
Your servers · generation, embeddings and reranking
For organisations that want no egress at all. The models run on your own servers, so nothing leaves them, and the platform runs fully offline. We configure it with you during deployment.
Your serversAny other infrastructure
Wherever the model you pick can be served
The platform is model-agnostic. If your infrastructure can serve the model you choose, that is where inference runs. No lock-in to one provider.
Your choiceIt has already run both ways
The platform has run fully self-hosted, with generation, embeddings and reranking all local, and on Bedrock, without losing a feature. Running the model where you choose is something this platform has been through, not a theory.
Every deployment ships with a one-page data-flow record
The exact model, the region and the retention setting, written down. It is built to drop straight into your DPO's register of processing activities.
No third-party AI vendor
Passages go to the model running in your infrastructure, whether Bedrock, Ollama or another host you run, and nowhere else. No AI vendor sits in between with terms of its own.
Swap the model, keep the index
The generation model sits behind a neutral internal contract, with Bedrock and Ollama as adapters, so the tools never see the provider and switching it needs no re-indexing. Changing the embedding model does mean re-indexing the corpus.
Terms change. Your setup does not.
Through 2025 and 2026, leading AI vendors moved consumer training to opt-out. You get a perpetual licence with the source code delivered, so your compliance posture is set by you, not by a vendor's next terms update.
How swappable each layer is, from the generation model to the vector store: the architecture, layer by layer.
Checks run before anyone sees an answer. Most of them exist to say no.
One question, followed from the moment someone presses enter. The only call that leaves the application goes to the model running in your own infrastructure, and it carries only passages this person may read.
Six control points
What happens on every question.
The same sequence, in full. Every step is recorded: the audit log holds who asked, when, which groups applied, and which passages the answer was built from.
01 Identity
The asker is authenticated through your own identity provider, so there is no second directory to maintain and no orphan accounts left behind when someone leaves.
Custom two-factor sits alongside single sign-on. You choose which groups must use it and how often it is re-checked, so the roles that can reach commercial, clinical or board-level passages can be held to a stricter rule than everyone else.
02 Group membership
The engine resolves which groups the asker belongs to before it reads anything. Groups model your real departments, sites and seniority levels rather than a folder tree that drifts when somebody reorganises a drive.
Being in a group and being able to change what is in it are separate rights.
03 Passage rules, applied at ingestion
Access is decided inside each document rather than at the file, and the rule is set when the document is indexed, not when someone asks. How passage rules work.
04 Filtered inside the search
Restricted passages are filtered out inside the search itself, on the semantic and the lexical half alike, before results are fused, and checked again after retrieval. They are not trimmed out of a finished answer. The model never sees them, so they cannot be summarised, quoted or inferred. All four checks.
This is why rephrasing the question, or asking it a different way tomorrow, changes nothing. Someone without commercial access is told the passage exists and who to ask, rather than being handed a softened version of it.
05 The model, in your own infrastructure
The model runs where you choose: AWS Bedrock in your own account, Ollama on your own servers, or any other infrastructure that serves it. It receives the authorised passages and the question, and never trains on them. On Bedrock nothing is retained; on your own servers nothing leaves them at all. Exactly what reaches the model.
06 A cited answer, and a log entry
The answer comes back with the document, the page and the highlighted passage it was built from, so any claim can be checked against the original by the person who asked or by an auditor reading it later.
If the answer is not in your documents, it says so and names what it would need, rather than filling the gap. Response time and token count are recorded on every answer.
Built for regulated Europe
Every question your compliance team will ask, answered before they ask it.
GDPR: EU jurisdiction, by architecture
Documents, index and processing stay in your deployment. The model runs in infrastructure you choose, in the region you choose, and your content is never used for training. No third-party AI vendor ever sees your documents. Data residency follows from where you deployed, so there is no setting to get wrong.
EU AI Act transparency
Cited answers and logged access make your internal AI use easy to document as the Act's rules take effect. Every answer already carries the document, page and passage it was built from, and the audit log records who asked what and when.
“Don't put our data into AI.”
A clause like this in a client contract no longer rules AI out. Their data never touches public tools and stays under your access rules. The clause in their contract and the architecture you run stop contradicting each other.
The approved tool that ends shadow AI
Bans do not work. 45% of employees now use AI regularly on work devices, and two in three of them go through accounts their employer does not control. A sanctioned assistant with permissions, an audit log and SSO is what replaces that.
Source: Verizon 2026 Data Breach Investigations Report, pp. 12 & 60.
Straight about the paperwork
What we are not claiming.
Security pages tend to blur the line between a property of the architecture and a certificate somebody paid for. These are not the same thing.
No certification badges on this page
We are not displaying ISO 27001, ISO 42001 or SOC 2 marks, because a badge belongs to an audited organisation and should be verifiable rather than decorative. Ask us directly where we stand and we will tell you, in writing.
Your own infrastructure is not the same as being secure
Running in your own infrastructure and region removes an entire category of risk. It does not harden your network, manage your identity provider or review your access rules for you. Those stay yours, and we would rather say so than imply otherwise.
Not "the model never reads your documents"
Passages and the question do reach a model: the one running in the infrastructure you chose, never a third-party vendor. We would rather tell you exactly that than use a line that sounds better and isn't true.
No hallucination rate
We don't publish a hallucination score, because we don't yet measure one automatically. We observe far fewer hallucinations than the same model used directly. That is an observation, not a measurement.
It is not a medical or legal decision system
The platform retrieves and cites. What to do with the answer stays with the professional reading it, and the product is built that way rather than disclaiming its way there.
Found a vulnerability? Tell us.
Write to [email protected] with the steps to reproduce, the version and what an attacker would gain. We will acknowledge the report and tell you what we are doing about it. Please do not test against another customer; we will not pursue good-faith research.
Bring your security team and your DPO to the demo
Book a demo
30-minute demo, on your files, no commitment.