AI PRIVACY ARCHITECTURE
The model reasons about the problem, not the person.
Nothing reaches a model except through the AI gateway, and the gateway decides per record and per field — never as one blanket judgement about your database.
STEP 1
Classify
Each field is graded: ordinary, personal, special-category, secret.
STEP 2
Minimise
Only the fields the task needs are assembled into the request.
STEP 3
Detect
Free text is scanned for names, contacts and health detail.
STEP 4
Transform
Names become placeholders. Health content is held back.
STEP 5
Decide
Your policy routes it on-prem, or refuses the request.
BEFORE — WHAT YOU WROTE
“Jan Kowalski slipped on the wet ramp at Dock 3, off work 9 days with a fractured wrist.”
AFTER — WHAT THE MODEL SEES
“PERSON_A slipped on the wet ramp at SITE_1, absence >7 days, injury detail [WITHHELD].”
RESIDENCY
France / EU
Records stay in the EU. Health data uses the on-prem model path only.
YOUR CONTROL
Three levels, or off
Choose how much the AI may use. Switching it off leaves the system fully usable.
ISOLATION
Per organisation
Every query filters by the signed-in session's organisation and role, server-side.