Security and data

Isolation model

On-prem and kiosk deployments run one customer per stack. Dedicated proxy host, dedicated GPU capacity, dedicated session state. No shared compute, no shared database, no shared cache with any other customer.

Hosted SaaS is multi-tenant by design; if that is unacceptable for your data, the on-prem shape exists precisely for that reason.

What leaves your network

On an on-prem or kiosk deployment, the conversation — audio, transcripts, retrieved documents, generated answers — stays inside your environment.

What our central infrastructure receives:

• Licence attestation: a periodic signed check that this deployment is entitled to run, carrying counts rather than content.
• Health and heartbeat: liveness, GPU state, software version.
• Audit events: administrative actions taken on the deployment.

No conversation content, no user audio, no transcripts.

One caveat worth being explicit about: if you choose a hosted language model (OpenAI, Anthropic, Google, and similar), the prompt and the retrieved context go to that provider under your contract with them. Running the model locally on the same GPU keeps everything on-premises — this is a genuine choice you make per deployment, and we will tell you what it costs in latency and quality.

Device authentication

Every GPU worker and every kiosk edge authenticates with its own certificate issued by an internal certificate authority. Registration, heartbeat, and session attestation all run over mutual TLS. A compromised or decommissioned device is revoked centrally, and it drains within one attestation cycle.

Device keys arrive as encrypted bundles and are decrypted at boot into memory-backed storage, not onto disk.

Audit log

Every administrative change, worker registration, and session attestation is written to an append-only audit log with actor, timestamp, and target. Operators review it in the admin console. It is the record we expect your auditors to ask for, and it is designed to be handed over.

Availability under licence failure

If a deployment cannot reach our licensing service — network outage, our problem, or a severed link — active conversations continue. The policy is fail-open. Central revocation exists for a genuinely misbehaving deployment, but your users do not lose service because a licence server was unreachable.

Compliance posture

We publish status honestly rather than claiming certifications we have not earned. On-prem isolation, device certificates, encrypted credential bundles, and the audit log are live today. GDPR and CCPA posture documents are available now. ISO 27001 is a target, not a claim. The current per-framework status, with dates, is on the compliance page.

For your security reviewer

Available under NDA on request:

• Architecture diagrams for all three deployment shapes
• Audit log schema and event taxonomy
• Certificate authority design, issuance and rotation policy
• Credential bundle format and key custody chain
• Information security, access control, and incident response policies
• Subprocessor list and data processing agreement template

We will also join a call with your security team before you commit to anything.