01
Your data sources
Read-only accessERPSAP, Oracle
CRMSalesforce, Dynamics
File repositoriesSharePoint, file shares
Other data sourcesDatabases, APIs, applications
← Trust
Trust
Security, privacy and data
One ring-fenced deployment, seen three ways: platform architecture, data privacy controls and control mapping.
SECURITY, PRIVACY & DATA
One ring-fenced deployment — architecture, lifecycle and mapping.
Same environment, three lenses.Stack, lifecycle and rulebook mapping describe one sovereign architecture — inside the client boundary, under client governance.
PLATFORM ARCHITECTURE · ON-PREM · RING-FENCED
A natural-language query interface over a ring-fenced stack.
On-premises, privacy-first enterprise AI — a natural-language query interface over a ring-fenced stack with read-only ERP/CRM connectors.
Authorised usersweb / application access only, authenticated via client IdP (OIDC / SAML)
Ring-fenced containerised environment (Docker) — no outbound internet dependency
AccessReact / Next.js UIReverse proxy · TLSOIDC / SAML (IdP)
NLP / QueryConversational query (chat)Intent & entity extraction (NER)NL → SQL / API translationContext & conversation memory
OrchestrationFastAPI backendAgent orchestratorRBAC & policyAudit & metering
Inference (Docs)LLM servingEmbeddingsRAG pipelinePII masking + guardrails
DataRelational databaseVector store · pgvector/QdrantRedis cacheMinIO object store
IntegrationConnector framework (read-only)Incremental sync / CDCSchema mapping
Client data sources — read-only · REST · OData · SOQL/Bulk API · JDBC/ODBC
ERPSAP · Oracle · D365 · NetSuite
CRMSalesforce · Dataverse · HubSpot
DatabasesJDBC / ODBC read replica
File repositoriesSharePoint · File shares
LanguagesPython (backend · AI · connectors)TypeScript + React (UI)SQL (data)PostgreSQL (primary application database · pgvector-ready)
DATA SECURITY & PRIVACY BY DESIGN
Your data never leaves your building.
Runs fully on-premises in a ring-fenced environment — your data stays in your environment, under your governance. Privacy lifecycle controls are in the next tab.
100% on-premisesNo cloud or internet dependency
02
Client network
Client infrastructureInternal, IP-restricted access03 · HERO ENVIRONMENT
On-premises Linux server
Docker container · ring-fenced
AI applicationBusiness logic
Local modelsInference
Data connectorsAPIs, DBs, files
SecurityAccess controls
Isolated container environmentNo direct user access to the core application or models · no external access · limited permissions
Host OS (Linux)Kernel security · SELinux/AppArmor · resource monitoring
04
Authorised users
Business usersWeb and application access onlyKEY SECURITY AND PRIVACY CONTROLS
Security and privacy by design, not by policy document.
Every control below is implemented inside the ring-fenced environment shown above.
01
Database security
- Least privilege database access
- Service accounts and passwords managed securely
- AES-256 encryption, TLS 1.2 connections
- Backups protected, access controlled by IT admin
02
Access security and RBAC
- Role-based access control (RBAC)
- Authorised users only
- Least privilege for application and data access
- Audit logging of access and activity
03
Pilot usage control
- Application runs limited during the pilot
- Agreed run and transaction quota
- Usage and remaining allowance monitored
- Limit increased only by client agreement
Your data. Your environment. Your control.Security controls are agreed with the client before production use.
DATA PRIVACY CONTROLS
Privacy is enforced at every stage of the data's journey.
Privacy is not a downstream policy check. It is applied as the data is collected, processed, stored, accessed and erased.
01
Collect
Data minimisation — only the fields needed for the task are read (read-only).02
Process
PII masked / redacted; processed by on-prem LLMs — prompts never sent externally.03
Store
Encrypted at rest; stored only within your environment.04
Access
RBAC & need-to-know; every access is audit-logged.05
Retain & erase
Configurable retention limits; supports right-to-erasure requests.Privacy guarantees built in
Your data is never used to train or fine-tune any model.
No cloud, no external transfer — data remains on-prem.
Data is not shared with any external party or service.
Used only for the agreed purpose; consent-aware processing.
Designed to align with
GDPRIndia DPDP Act 2023ISO/IEC 27701
Controls configurable to your data-protection policy.Privacy by design.Enforced inside your environment, under your governance.
DATA-PROTECTION CONTROL MAPPING · ON-PREM · RING-FENCED
Built-in controls, mapped to the region's rulebooks.
How Vectasense's built-in controls align to GDPR, India's DPDP and Singapore's PDPA — enabling controls, not a compliance certification.
| Control we built | GDPR | DPDP (India) | PDPA (Singapore) |
|---|---|---|---|
| On-prem / ring-fenced — no outbound internet | Ch. V transfers · Art 32 | Data-localisation-friendly | Transfer limitation |
| PII masking / redaction before the model | Art 25 — data protection by design | Data minimisation | Protection obligation |
| Encryption at rest & in transit | Art 32 — security of processing | Security safeguards (Rules) | Protection obligation |
| RBAC & least privilege | Art 32 — security of processing | Access control | Protection obligation |
| Audit logging of access | Art 5(2) — accountability | Fiduciary accountability | Accountability |
| No training on client data | Purpose limitation | Purpose limitation | Purpose limitation |
| Retention / erasure support | Art 17 — right to erasure | Erasure on purpose completion | Retention limitation |
Enabling controls only. Full compliance also requires organisational measures — DPA, DPIA, lawful basis, breach notification, DPO / grievance officer.