Security & data flow
Everything behind your firewall.
For IT management, information security and data protection: where data flows, which security features exist – and what their status is. Honestly labelled as available, in trial or planned.
In brief
- Language models run locally
- AIFIDIS sends no telemetry to the vendor
- Additional models only by admin decision
- Your documents do not train any models
Data flow
Where your data is stored.
Your environment · on-premises, appliance or dedicated server
Users
Browser via HTTPS · roles per company and group · SSO via OIDC (in trial)
AIFIDIS
Capture, search, answer with local language models · audit log · database and search index
Your data
Upload · network drive (SMB) · PDF, Office, scans, audio
Additional models via API – your decision: AIFIDIS can address additional language models via an API, such as your own LLM servers at other locations or, if you so choose, external providers (e.g. OpenAI, Anthropic). Only your administrator decides which models are connected. Retrieving approved web pages is also optional, restricted to an allowlist and protected against access to the internal network.
Security features
What's included. What's coming.
| Area | Implementation | Status |
|---|---|---|
| Encryption | TLS via an upstream reverse proxy | Available |
| Sign-in | Local accounts | Available |
| Single sign-on | OpenID Connect (e.g. Entra ID, Keycloak), group import | In trial |
| Permissions | Roles (super admin, company admin, user); permissions per group and knowledge space with the levels read, write, admin | Available |
| Tenants | Multiple companies per installation, logically separated | Available |
| Audit log | Security-relevant actions and every query (optional, can be switched off); entries are only appended – the application can neither change nor delete them | Available |
| Prompt injection | Detection patterns for documents and chat, extendable by the admin. Supplied: English-language patterns; German-language patterns to follow | Being expanded |
| Data protection | Access (export) and erasure per user | Available |
| Licence | Offline licence file, RSA-4096 signed, no online activation | Available |
| Operation without internet | Air-gapped operation | In trial |
| Two-factor sign-in | TOTP | Planned |
| SIEM | Forwarding of security events | Planned |
| Certification | ISO/IEC 27001 | Planned |
Data protection
Who is responsible for what.
On-premises & appliance
You remain solely responsible
AIFIDIS does not process any personal data on your behalf, as long as no remote maintenance takes place.
Dedicated hosting
We are a processor
With a data processing agreement under the GDPR and the Swiss FADP, and disclosed technical and organisational measures.
EU AI Act
Support for deployers
Logging, source references and permission management help with your obligations as a deployer. They do not replace the legal classification of your use case.
Operation & updates
Tested before every release.
- Delivered as container images with fixed version numbers
- Every version passes more than 1,800 automated back-end tests
- Built-in quality measurement for answer accuracy
- You install updates – or we do, by arrangement
Hardware (on-premises)
| GPU | NVIDIA, at least 20 GB VRAM; for text recognition and language model in parallel, 48 GB or two GPUs |
| Memory | 64 GB |
| Storage | SSD, depending on document volume |
| System | Linux with Docker |
No suitable hardware? Appliance or dedicated server – see operating models.
Documentation
Architecture, TOMs and template DPA on request.
Does your IT security team have questions? We answer them directly – also in a conversation with your information security officer, if you wish.