Point AI at your data — without losing control.
The first question every team asks is "great — but is it safe?". Here is the honest, complete answer: where your data lives, who can see what, what we deliberately don't do, and what you can verify in writing before you sign anything.
Your data store and bulk data stay in your tenant. Per-query results transit an approved EU-region, zero-retention model endpoint under a signed DPA. AccuraSee never uses your data to train models — and you can verify every word of this in writing before you sign.
We will never tell you that nothing leaves your environment. We will show you exactly what does, when, and under what terms. That candour is the point.
One gateway between any AI client and your data.
The whole design splits in two because mainstream AI clients call from a vendor's cloud, not a laptop: a public, authenticated front door and a private, in-tenant back end — with your data never exposed to the internet.
Client → Gateway · public
AI clients reach the Gateway over HTTPS, authenticated with OAuth 2.1 via Microsoft Entra ID — strict token validation, a pre-registered client, and an explicit tool allow-list. There is no generic "run SQL".
What this means for you: only your authenticated users, through approved tools, ever reach the door.
Gateway → data · private
Never public. The Gateway reads your data over a private connection (encrypted tunnel in a pilot; VPN / ExpressRoute with a Private Endpoint in production), read-only, through governed views. The database itself is never internet-exposed.
What this means for you: the database stays sealed inside your tenant — the AI only ever sees a curated, read-only window.
Gateway → documents
Contracts, invoices and definitions come via the Microsoft Graph API with scoped permissions, or a locally-synced folder that inherits the signed-in account's access.
What this means for you: documents follow the same permissions your people already have — nothing wider.
The Gateway is the enforcement point.
Identity is not checked once at login — it sits in the middle of every single call, and decides what comes back.
Identity on every call
The Gateway validates the Entra token, resolves the real user, and keys everything downstream — query filters, tool access, audit — to that identity. Your existing Entra MFA and conditional-access policies apply.
Row-level & attribute security
Server-applied, identity-driven filtering injected in the governed view layer — per business unit, per object, public-vs-confidential. People only ever see what they are entitled to.
Encrypted, end to end
Traffic is encrypted in transit (TLS); data is encrypted at rest on Azure. The model endpoint is reached over an encrypted, EU-region connection under a DPA.
The resolved position, stated plainly: the middle tier over governed views is the primary enforcement point. We do not impersonate users into the database (no on-behalf-of) — the database sees a single read-only service account while the Gateway enforces each user's identity. Dashboard-level security (e.g. Power BI) remains for its own reports; it is secondary, not the AI's security model.
The boundaries are as important as the features.
No free-form SQL
The AI cannot write or run arbitrary queries. It calls predefined, governed tools over allow-listed views — and nothing else.
The model never holds database credentials
No AI client or model is ever given a connection to your database. The Gateway is the only thing that reads data, on a read-only account.
We don't keep copies elsewhere
Your data and audit logs live in the hosting tenant — your own by default, or the dedicated EU environment we run for you. Per-query results are processed in transit by a zero-retention model endpoint and aren't retained there.
AccuraSee doesn't train on your data
Your data is never used to train or improve models — not by AccuraSee, and (under the DPA's zero-retention terms) not by the model provider either.
No shared multi-tenant data pool
The Gateway runs in your own environment. Your data is never co-mingled with another customer's.
No silent answers
When the Gateway can't ground an answer in your governed data, it blocks and says so — it does not improvise.
Security includes being right.
A confident wrong answer is its own kind of risk. The Gateway is built so you can trust the number, not just the network.
Source-cited, every time
Every answer carries the figures' sources, the as-of date, and any caveats — so a person can check the work, not just the headline.
Verified against a golden set
Answers are reconciled against a golden set of questions with independently computed results — the difference between "seems to work" and something you can put in front of an auditor.
Honest when it can't answer
If a question can't be answered reliably from the governed data, the Gateway returns a clear "blocked" state instead of guessing.
Every question logged. Everything stays yours.
A per-user audit trail
Who asked what, when, and the exact query that ran — recorded append-only and reviewable, held in the hosting tenant (your own by default). Shared accounts finally reconcile with accountability.
The deployment lives with you
By default the Gateway, its audit logs and your data sit inside your own Azure tenant — we hold no copy, with nothing to repatriate.
A clean exit, by design
Infrastructure-as-code, configuration and documentation are built to hand over. No proprietary export format, no lock-in.
If you'd rather we host it: AccuraSee can run the Gateway in a dedicated, AccuraSee-managed EU environment (Azure, Sweden Central) instead of your own tenant. Your data and audit logs then live there — with the same identity, row-level security and audit, still EU-resident and under the same signed DPA — and everything is still built to hand over to you whenever you want it in-house.
Built for European data rules from the first line.
EU region, controller & processor
The region is pinned in the EU (Azure, Sweden Central). You are the data controller; AccuraSee, operated by iSolve AB, is the processor, acting only on your documented instructions under a signed DPA.
Named sub-processors
The sub-processors involved — the Azure platform and the approved model endpoint — are named in your DPA, with notice of any change so you can object.
International transfers, handled
Where a sub-processor has a non-EU parent (e.g. Microsoft), transfers are covered by Standard Contractual Clauses and, where applicable, the EU–US Data Privacy Framework.
Data-subject rights
As processor, AccuraSee assists you in responding to access, erasure, rectification and portability requests, per Article 28.
Breach notification
If we become aware of a personal-data breach, we notify you without undue delay so you can meet your own 72-hour obligation to the supervisory authority.
Retention, defined
Retention and deletion of query logs and the audit trail are set in the DPA, with return or deletion of data at the end of the engagement.
Straight about roles: We're a focused team, not a large enterprise, and have not appointed a formal Data Protection Officer (and are not required to). Sebastian Hamilton is our named data-protection contact. For the full detail on lawful basis, transfers and your rights, see the Data Processing and Privacy pages.
The new risks AI brings — and how the design answers each.
Prompt injection
A cleverly-worded prompt can't escalate access: the tool allow-list and predefined tool signatures mean there is no path from free text to an arbitrary database command.
Data exfiltration via the model
The only data leaving the views is the governed result envelope, scoped to the user's permissions and source-cited. The model is never handed raw, unfiltered access.
Hallucination
Answers are grounded in governed data, source-cited, and reconciled against a golden set — and the Gateway blocks rather than invent when it isn't sure.
Answered straight — including the hard parts.
Can AccuraSee staff see our data?
Not in normal operation. By default the Gateway runs inside your own Azure tenant, and your data and audit logs stay there; if you ask us to host it, it runs in a dedicated AccuraSee-managed EU environment instead, with the same controls. AccuraSee has no standing access to your business data through the product. Because we deploy and maintain the Gateway, designated AccuraSee engineers can be granted scoped, time-boxed access to your tenant only when you authorise support or maintenance — and that access is logged in your tenant, under your control, and revocable by you at any time. We never use your data for anything other than the support you have asked for, and we never use it to train models. The DPA sets these limits contractually.
Where exactly does our data go when we ask a question?
Your data and audit logs stay in the hosting tenant — your own by default, or a dedicated EU environment if you ask us to host. To answer a question, the Gateway reads only what it needs through governed, read-only views, then sends that result to an approved EU-region, zero-retention model endpoint under a DPA — which processes it and returns an answer without retaining it. We do not claim "nothing ever leaves"; we tell you exactly what does, where it goes, and on what terms.
Do you train AI models on our data?
AccuraSee never uses your data to train models. The model endpoint the Gateway calls operates under a DPA on a zero-retention basis — your queries are not kept or used for training there either. The specific provider and its contractual terms are named in your DPA so your team can verify them.
What if the AI gives a wrong answer?
The Gateway answers only through predefined, governed tools over allow-listed views — never free-form SQL — and every answer is source-cited. Correctness is checked against a golden set of questions with independently computed answers. When something cannot be answered reliably, the Gateway says so and blocks, rather than guessing.
What happens if we want to leave?
There is no lock-in. When it runs in your own tenant, the deployment, audit logs and data already live with you and remain yours. When we host it for you, every artifact — infrastructure-as-code, configuration, documentation, and your data and logs — is built to hand over cleanly, so you can take it in-house or migrate without us.
Is it GDPR-compliant, and is it in the EU?
The region is pinned in the EU (Azure, Sweden Central). You are the data controller; AccuraSee, operated by iSolve AB, is the processor, acting on your documented instructions under a signed DPA with named sub-processors. Every question and answer is logged per user. The Data Processing page covers roles, transfers and your rights in detail.
Put it in front of your security team.
We'd rather be reviewed than take your word that you'll review us. Get the brief, read the DPA, or walk the architecture live with the people who built it.
Ask your business data anything. Get an answer in seconds.
Start with a discovery call — we'll scope a low-risk pre-study and show you what's answerable on your data.
What to expect: a 30-minute call · we map your data sources · a live answer on your data — no pressure.