For IT and security teams
Security and architecture
Background for your vendor assessment. It covers where the system runs, who can access what, and what happens if you leave us.
- Where it runs
- On a server that belongs to you
- Encryption key
- You hold it
- Management link
- Outbound only, you can cut it
- Logs
- Stay on your server
- Versions
- Pinned, nothing updates on its own
- Main model
- Google's Gemma, on your server
- If you leave
- The system keeps running
Architecture
The whole system runs on a server that belongs to you: either in your own server room, or as a dedicated server rented in your name in a Czech data center.
Employees sign in with their company account. Every request goes through the Gateway, which checks the sign-in and permissions and writes an entry to the audit log. Only then does the AI server process it. The documents the AI answers from, and their search index, sit on the same server.
We manage the system remotely only over an outbound connection from your server to us. Without that connection, we have no way in. You can cut it at any time and your AI keeps running. We just cannot do any maintenance until you turn it back on.
The connection is on. Only technical operating data goes out.
Who can access what
We set up access to match your organizational structure. By default:
| Who | Documents | Conversations | Technical operating data | Encryption key |
|---|---|---|---|---|
| Employees | based on permissions | their own only | no | no |
| Your administrator | yes | per contract | yes | yes |
| Appnestiq | per contract | per contract | yes, via the outbound connection | no |
We do not see the content of conversations. Our only access to the server is the administrative access that maintenance requires, and only over a connection you can cut.
Encryption and keys
The server's disks are encrypted. You hold the key. Without it, not even the data center can access the data on a powered-off server or a removed disk.
Traffic between employees and the Gateway is encrypted (HTTPS).
Models and where they come from
We use open models that run directly on your server. The main model for chat and answers is Google's Gemma. We would switch to a main model of Chinese origin only at your explicit request.
With every deployment you get a list of the models used, with their origin and license, as input for your risk assessment.
Updates and pinned versions
Every part of the system runs on a pinned version. Nothing updates on its own.
We deploy updates and new models in an agreed maintenance window, and tell you in advance what will change.
What is logged and what is not
Logs stay on your server. Only technical operating data goes out.
| Data | Where it stays | Who sees it |
|---|---|---|
| Gateway audit log (who used the system and when) | on your server | your administrator |
| Content of questions and answers | per contract | per contract |
| Technical operating data (load, errors) | sent to us over the outbound connection | Appnestiq, your administrator |
Incident response
- 7.1We detect the incident through monitoring, or you report it to us.
- 7.2We notify you, and together we decide whether to cut the management connection.
- 7.3We investigate the incident and fix the cause.
- 7.4You get a written report on what happened and what we changed.
Leaving us
The system keeps running after you leave. You are not dependent on us:
- 8.2We hand over all data, settings and system documentation.
- 8.3We hand over all access credentials and revoke ours.
- 8.4We turn off the outbound management connection.
- 8.5The system keeps running on your server. You can manage it in-house or with another vendor.
Documents for your risk assessment
For a risk assessment under the Czech Cybersecurity Act (NIS2) and for your vendor assessment, we provide:
- A description of the architecture and access
- A list of models and software with their origin and licenses
- A description of the supply chain (data center, hardware, software)
- The incident response procedure and the exit plan
Next step
Let's walk through it with your IT team
In the demo, we'll answer technical questions from your IT staff or security manager.