Security
Security and deployment overview
Private by design should be something you can evaluate. This page says where your data goes in an Eleticle deployment and which controls are in place. It states only what is implemented today, and it names what is not. Personal information collected through this website is covered by the Privacy Policy.
Last updated: 8 September 2026
Where your data goes
“Private AI” is not shorthand for nothing ever leaving your premises. For each part of a deployment, this is what stays on private hardware and what, if anything, an approved outside service receives.
| Component | Stays on private hardware | What leaves, and to whom |
|---|---|---|
| Documents and files | Uploaded into your organisation’s own area of the workspace, parsed and indexed on the deployment’s private hardware. | Nothing. No outside service receives your documents at any stage. |
| Model inference | Every model call, embedding and document OCR runs on private hardware inside the deployment’s network. There is no cloud model behind it and no fallback to one. | Nothing. The one exception is web search, which is off by default; if your build enables it, the search service is named in your agreement. |
| Speech processing | Transcripts and bookings from a phone receptionist build are stored in your workspace. | Call audio and live transcription pass through the voice provider named in your agreement. The workspace itself contains no speech service. |
| Email and calendar | A connected mailbox is linked per user through Gmail, Microsoft 365 or Zoho Mail sign-in, with only the permissions that user grants. The assistant reads and drafts through that provider’s interface. | Your mail stays with your mail provider, where it already is. Calendar services are not connected today; a booking build names the calendar service it uses. |
| Logs and audit records | An append-only audit log records who did what: sign-ins, role changes, licences, each assistant tool call and its outcome, support access. Assistant conversations are stored on the same private hardware. | Nothing. The audit log never stores document content or the arguments of a tool call, and no analytics, telemetry or error reporting is sent out of the deployment. |
| Backups | Nightly copies of the database, files, secrets store and assistant state go to a separate backup store on infrastructure Eleticle controls. | Nothing. Backups are not sent to a third-party backup service. |
| Support access | Support sees membership and audit records only, under a scoped grant that expires, and every use is written to your audit log. | Nothing. There is no log-in-as-user, and support cannot open documents, mailboxes or conversations through the product. |
Authentication
Sign-in runs through a dedicated identity service using OpenID Connect with PKCE. The workspace holds no passwords of its own, and repeated failed sign-ins are locked out.
Sessions are encrypted cookies that expire after 12 hours. Every request re-checks the user’s membership and access in the database, so a removed user is refused at once.
Administrative actions, such as changing roles, licences or export destinations, require a second factor (an authenticator app code) entered within the last five minutes.
Permissions
Access is organised by organisation and by application. A person can open an application only when their membership is active, the organisation holds a licence and an administrator has granted that person that application.
Assistants inherit those permissions and nothing more. What an assistant may read or do is recalculated on every call from what the person asking is allowed to open right now, and a read-only surface is refused write actions even if one is requested.
Roles are organisation administrator and member. Within an application, records can be limited further to their owner and administrators.
Customer isolation
Each organisation’s records are separated by row-level security enforced inside the database itself, on every table, including the search index. A query can only ever see the organisation it was opened for.
Files are stored under an organisation-specific prefix that is validated on every read and write. Each person’s assistant runs as its own profile with its own credentials, so one profile cannot read another’s state.
Isolation is tested automatically: the monthly restore drill restores a backup into scratch storage and re-runs the isolation tests on the restored data.
Encryption
Traffic between your browser and the workspace is encrypted in transit. The hosted deployment accepts no inbound connections; it reaches the internet through an outbound tunnel, and its administrative consoles are reachable only from the host itself.
Credentials and secrets, including mailbox tokens and assistant keys, are held encrypted in a dedicated secrets store and are never written to ordinary database columns. Session cookies are encrypted.
The database and file volumes themselves are not encrypted at rest today; they are protected by the host being private, with no open ports and no remote administration tools. We say so rather than imply otherwise.
Backup and restore
Backups run nightly and cover the database, files, the secrets store, assistant state and the skill library, with a checksum manifest for each set. Thirty daily and twelve monthly copies are kept.
The backup credential cannot delete anything, and each run proves it. A restore drill runs automatically on the first Sunday of each month: it restores into scratch storage, removes and restores one organisation’s records checking the counts, and records the result where the health page grades it.
Updates
Eleticle applies updates to a hosted deployment. Each update is preceded by a backup, uses append-only database migrations, and finishes by checking that the public address serves the new build.
For a deployment on your own hardware, the update schedule and who applies updates are agreed in the project, and the same procedure is used.
Support access
Platform administrators have no standing access to any organisation’s data. Support requires a grant with a stated reason and an expiry, limited to membership and audit records, and every use is logged as a support event in your own audit console.
Eleticle administers the host a hosted deployment runs on. That access is to the operating system, not through the product, and it is how backups, updates and restore drills are run.
Retention and offboarding
Your workspace data is kept for the life of the agreement and belongs to you. Organisation administrators can set up a continuous export to storage you control, hourly or daily, with a checksum for every record.
On offboarding, Eleticle suspends the organisation, revokes mailbox connections and assistant credentials, and deletes its records, files and secrets in one step. Copies in backup sets expire 30 days later. The audit history is retained as a record of what happened.
What this page does not claim
- No third-party certification such as ISO 27001 or SOC 2 is held, and none is implied.
- Deployments on your own hardware, whether rented, supplied or existing, run the same stack. Network, physical and disk controls on that host are yours, or agreed in the project, and this page describes the hosted deployment.
- Every outside service a workflow uses is named in your agreement with what it receives. If a service is not named there, the build does not use it.
Questions from your IT reviewer
Send them to info@eleticle.com and they will be answered by the person who runs the deployment.