Start with trust boundaries
The public website, demonstration, administration and customer AI installation have different users and risks. They must not share unrestricted access to data, models or administrative interfaces.
Check access before producing an answer
Authenticating a person is not enough. Apply organisation, role and document permissions before search. Examine indirect routes too: conversation history, exports, caches and logs.
- Least privilege and separate service identities.
- Administrator MFA and limited sessions.
- Validation, limits and traceable significant changes.
The model is not an access-control authority
Instructions inside a document may be hostile. Retrieved text is treated as data, not permission to act. The application controls access and tools. Generated responses are displayed as text and remain subject to review.
Operations belong in the security scope
Encryption, key management, backups and monitoring depend on the environment. Configure and verify them during deployment, rather than merely drawing them in a diagram. A recovery exercise is a separate acceptance criterion.
Claims we do not make
Neither local deployment nor an automated test proves complete security. We do not claim certification or compliance with GDPR, NIS2, DORA, ISO 27001 or the AI Act without applicable assessment and documented evidence.