Documents, tickets, credentials, and the conversations your team has about all three. This page is the plain-language version of how that is kept: the one rule the product follows, what the AI can and cannot see, and where the legal documents live.
InsideAI answers as you, with your access — and the server is what enforces that, never the screen.
Hiding a button is a courtesy. Every request is checked in the backend regardless of what the interface offered, so there is no address to type your way past a rule.
Data is scoped to the organization you are acting in. Belonging to two of them does not let anything cross between them.
Credentials are encrypted at rest and returned masked. Nobody — including your own admin — reads one back out of the interface.
A question runs with the permissions of the person who asked it. Two people in one shared conversation can get different levels of detail, and that is correct.
Scheduled work runs as nobody by default, so it reaches only material that was already unrestricted. Your admin can deliberately have a job run as one of your people instead: it then sees exactly what that person sees, the choice is re-checked at every run, and it falls back to nobody the moment that person leaves.
We do not train models on your content. Your knowledge base is indexed so your team can search it for answers — never published, never exposed.
Our AI runs on Google Cloud's Vertex AI, under an enterprise arrangement rather than a consumer one. Your prompts and documents are never used to train or improve Google's models, are encrypted in transit and at rest, and are never mixed with another customer's.
Every question is answered by a model running in a US Google Cloud location, never a global or overseas one. The one exception is web search: a question you choose to ask with Google Search on is searched outside that guarantee, and the product says so when you switch it on.
It is the same question we would ask, and the answer is not “everything”.
Ask a question and the search runs with your access — your own conversations, plus whatever your organization has put in front of everyone in it.
In a connected system you signed in to yourself, InsideAI acts as you: it sees your workspace and nothing wider.
Signing in to an outside system happens on that system's own site, so InsideAI never sees that password. The exception is the one administrator-level system that publishes no such site: there the sign-in — and the security code it asks for — is traded for a token inside a single request, never stored, never logged, never shown back, and the attempt is rate-limited so it cannot be used to guess at an account.
Notes the AI keeps for itself inherit the access of the question that produced them, so they can never end up wider than the person who caused them could already see.
A note that stands in for something the AI looked up has to carry the address of it rather than the value, and that shape is checked when the note is written rather than merely asked for — so it re-reads the live figure at the time it is used. Every note is hard-capped in length as well, so none of them can become a store of your data in its own right.
Published by CP Cyber and linked here rather than restated, so there is only ever one current version of each.
Have a specific compliance question — retention, residency, a particular certification? Ask us rather than inferring an answer from this page.
Ask a security questionStraight answer on where we are: InsideAI is early. It is deployed and doing real work inside real businesses, and we are taking on a few at a time on purpose — every deployment gets a person on it, not a ticket queue.
Tell us what your team runs on and what you would want it to answer. We will be straight with you about what fits today and what is still ahead, and coming in now means real say in what gets built next.
Talk to usReach a person
Call (720) 541-8910
Email sales@cpcyber.com
Connect on LinkedIn