Security and data privacy
Your data, your rules
When considering an AI assistant, organisations rightly ask: where does it run, what does it answer from, who sees the conversations and how is compliance handled? Here is an overview of our approach.
Where the assistant runs
- The assistant can be installed locally, on the organisation's own infrastructure, or in the cloud (AWS).
- To generate answers, the assistant uses a language model which, by default, is called via an external provider's API (e.g. OpenAI), unless configured otherwise.
- With local installation, language models are used on a BYOK basis (bring your own API key); OpenAI and Anthropic are supported. With cloud installation (AWS), the platform's keys are used.
Answers only from the approved knowledge base
- The assistant answers only from content approved by the organisation (web pages, documents, guidelines).
- When the answer is not in the knowledge base, it says so and refers the user to a contact – it does not invent.
- For sensitive areas, additional rules apply, e.g. no medical, legal or financial advice.
Control over content
- The organisation decides what goes into the knowledge base, and when and how it is updated.
- Content can be added, corrected or removed at any time; the schedule for automatic knowledge base updates is set in the admin module.
Keys and access
- With local installation and BYOK, credentials and API keys remain owned and controlled by the organisation.
GDPR and the EU AI Act
Transparency
Users are clearly informed that they are talking to an AI assistant.
Human oversight
For complex or sensitive questions the assistant refers users to a person; the organisation keeps control of content and operating rules.
Logging
All conversations are logged and archived for 12 weeks, enabling quality control and traceability.
GDPR
Our approach is based on data minimisation; roles (controller, processor) and contractual arrangements are agreed with each client.
Recommended practices
- Do not include personal or sensitive data in the knowledge base – the assistant does not need it.
- Data minimisation: don't ask users for personal data in conversations unless necessary.
- Access control: restrict access to administration, the knowledge base and logs to authorised staff.
- Regularly review knowledge base content and the assistant's answers.
What we do not claim
This page does not state certifications, specific encryption methods or data storage location. These details depend on the chosen deployment and are agreed with each client individually.
Questions about security and compliance?
Contact us via comp-consulting.eu (opens in a new tab) – we're happy to review them together with your IT and data protection team.