You decide who sees what. Always.
Not OpenAI, not Anthropic, not any hyperscaler. The model lives where your data lives.
No usage telemetry, no prompt logs to a vendor, no fine-print exception. Air-gappable by design.
Swap in your own model. Open-source foundation, your choice.
No. No outbound API calls: the model, the index, and the data all run inside your perimeter.
Role- and workspace-based permissions, enforced at the source of every answer, not just at the chat window.
Every query, every source used, every action taken, in an append-only, tamper-evident log.
