Security & data sovereignty
Your data stays in-house.
Because the AI is there.
The AI is in your building. Every question, every document, every answer is processed on your own hardware. No cloud account, no US provider in the processing chain. Remote access for maintenance exists only with your approval and is logged. This isn't a promise, it's the design.
Where your data is
Everything within your own four walls.
With cloud AI, the question “Where is my data?” is a contractual question. With your own AI, it's a question you can answer by pointing.
AI processing needs no outbound connection. It also runs without internet access. Only connections to cloud services such as Microsoft 365 and remote maintenance need a connection, and you decide on that.
- No cloud AI provider, no account, no API key
- No US provider in the processing chain
- No third-country transfer for AI processing
- No data processing by an AI service
- No use of your data to train third-party models
Optional outbound connections: updates, remote service and connections to cloud services such as Microsoft 365, each only when you approve them. Updates and remote service are logged; connections carry the permissions you grant for them.
In practice
What “in-house” means day to day.
Maintenance & remote service
If we need to access your system, you'll see it.
An AI system needs upkeep. How that happens is part of security, not its opposite.
- You open the door, not us. Remote access exists only when you approve it. Whether for a single session or permanently is your decision.
- Every session is logged. Who, when, what: traceable in your system.
- Maintenance needs no copy of your data. We work on the system itself, not with exports.
- It also works without remote service. Updates then come as a package that your IT installs itself.
Roles & permissions
The AI follows your organisation.
Management may query HR records, sales may not. Purchasing sees supplier contracts, production sees the drawings. Your AI takes on these boundaries from your existing permission structure and answers each person only from what they could open themselves.
Honestly
What we don't promise.
You won't find a guarantee on this page that we can't keep. That's deliberate.
No “absolute security”
No system is unassailable, not even one in your own basement. What we give you is control: you know where your data is, who has access and what the system does. That's a different starting position than with a service you can only control through contracts. But it's not a guarantee.
No blanket “GDPR compliance”
The system is designed for data-protection-compliant operation. But the specific assessment depends on your processing and your configuration. Data protection is a process within your company, not a property of a device. We document precisely what the system does and doesn't do; the assessment itself is one you make with your data protection officer. We help with that.
No error-free AI, no certificates we don't have
AI answers can be wrong. That's why your AI names its sources, and why we test against your actual cases before handover. Responsibility for decisions stays with the people making them. And: we don't advertise ISO or BSI certifications we can't produce. What we can produce is set out in the technical description.
For your data protection officer
The facts they need.
Short and without marketing. We provide a detailed technical description on request.
- Processing of personal data exclusively on hardware owned by, and located on the premises of, the data controller
- No data processing by an AI cloud service; no third-country transfer for AI processing
- Access restricted according to the existing permission structure; logging kept locally
- Deletion and retention under the control of the data controller; no copies held by DataFlowFacts
- Remote service only with approval, with a session log; for this we conclude a data processing agreement with you
- No use of customer data to train models, by DataFlowFacts or third parties
- Designed for data-protection-compliant operation; the assessment depends on your processing and configuration: technical and organisational description on request
Please align the data-protection assessment for your company with your data protection officer.
Frequently asked questions
On security and data protection
We have a company ban on AI. Why should we change that?
A ban rarely protects anything. In practice, employees then use private accounts on their own phones, and the data ends up leaving anyway, just invisibly. Your own AI solves the problem behind the ban: you get the benefit without anything leaving the building. You can keep the ban on third-party services.
What's the difference to a German or European cloud provider?
The data centre's location is an improvement over a US provider, but your data is still with a third party. You still need data processing agreements, remain dependent on their terms and prices, and have no physical access. With your own AI, the third party is removed from the equation.
How do updates get onto the system if it's not connected to the internet?
Either you open the connection for the update process and close it afterwards, or your IT installs the update as a package. With remote service, we handle this with your approval. In every case, none of your data is transmitted: only the update comes in.
Can DataFlowFacts access our data?
Not without your approval. Without remote service, we have no access to your system. With remote service, access exists only within the scope you define, and every session is logged. For this we conclude a data processing agreement with you.
What happens if the hardware fails?
With AI Compact and AI Team, the AI runs on a single system. If it fails, the AI is down until the device is repaired or replaced; your documents aren't affected, as they stay on your drives. We back up the configuration and knowledge index so they can be restored on a replacement device. AI Enterprise is redundant by design: two systems, and the failure of one can be absorbed by the other. We don't give a guarantee of uninterrupted operation. That wouldn't be honest for any system.
How are our employees' access permissions taken into account?
The AI takes on the permissions from your existing structure: roles (for example management, finance, sales) and access areas (folders, archives, systems). A question is answered only from sources the person asking is authorised for. Anyone who isn't allowed to open a personnel file won't get an answer from it either. How fine-grained this structure is, you define together with us during setup.
Does the AI get access to our company IT when we connect systems?
Not blanket access. A connection means the AI talks to exactly the system you approve, with exactly the permissions you grant for it. Read access follows your permission structure: whatever the person asking is not allowed to see in the source system, they will not get from the AI either. Defined actions, such as creating an issue or updating an entry, we only set up where the interface provides for them and you explicitly approve them. The integration configuration is documented and traceable; it is part of the technical description you can request.
What happens if the device is stolen?
The system's storage drives are encrypted; without the key, the data is unreadable to third parties. As with any server: a lockable room is part of the concept. We discuss this with you during setup.
Ready for your own AI?
Put your package together in a few minutes, or first check whether your existing hardware is sufficient.