Companies are wiring AI to their internal data at a remarkable pace, and most of the security conversation happens after the wiring. This post lays out the threat model that matters for any AI that reads company data, the controls Naxis Assistant, our private knowledge engine, holds itself to today, and the goals we would set for the industry.
The threat model that matters
Any AI over company data is a new privileged surface. It aggregates read access that used to be scattered across systems, and it exposes that access through the least formal interface a company owns: a chat box. Five risks dominate.
Authorization collapse. If the system can read everything, every user effectively can too. Permission checks bolted onto the interface fail the first time a new surface (a channel, an API, an integration) forgets to call them. The control that works is authorization inside the retrieval query itself, so no request path can widen access.
Boundary leakage. Every answer moves some data through a model. The questions that matter: what exactly leaves, whether it is retained, whether it is trained on. The strongest posture sends nothing at all: a self-hosted deployment answering on a self-hosted, open-weight model. Where a hosted AI service is used instead, the defensible posture is permission-filtered excerpts only, a data-processing agreement with zero-retention terms, and no training on customer data, stated in the contract rather than in marketing.
Tenant bleed. Pooled platforms concentrate many companies' corpora behind one control plane, so one authorization bug is everyone's breach. Single-tenant deployment turns the blast radius of a platform bug into the blast radius of one instance.
Credential concentration. Connectors hold credentials to the systems that matter most. Those credentials should be read-only in scope and write-only in storage: accepted, used, never displayed again. The instance itself should hold no AI-service keys at all, so a compromised server cannot leak what was never on it.
Unverifiable behavior. If you cannot reconstruct what was asked, what was answered and what was cited, you cannot answer for the system to an auditor, a regulator or your own board. The log has to be append-only and tamper-evident, and verifying it has to be routine, not forensics.
Prompt injection deserves its own line: it is not solved, anywhere. The honest mitigation today is scope. A system that only reads, cites its sources, verifies those citations mechanically and takes no actions gives an injected instruction very little to do. Systems that execute actions need a categorically higher bar, and mixing the two without human decision points is the mistake the industry is currently rehearsing.
The bar we hold ourselves to
Naxis Assistant is a private knowledge engine: a single-tenant deployment that connects to a company's own documents, mail, CRM and databases and answers each person's questions from that knowledge alone, within that person's permissions, with sources cited. The controls above are not aspirations for it; they are shipped in every deployment: single tenancy with one database per client, group filters inside every query, platform-verified webhooks, write-only secrets, a hash-chained audit log with one-click verification, signed release artifacts with automatic rollback, and rate-limited, challenge-backed sign-in surfaces.
On certification we say exactly where we stand, and we keep the status where it can stay current: the ISO/IEC 27001 track and the SOC 2 Type II track each have a status page showing the work station by station, done, in progress and remaining. Neither is claimed until it is held. Reviewers can read the architecture record today, and a standing request filed from your account delivers the certificate or report the day it exists.
Read the architecture record Request the documents
Goals we would set for the industry
- Authorization at the retrieval layer as table stakes. Interface filters are not a security boundary.
- A published data-flow statement per product: what leaves the boundary per request, what is retained, by whom, for how long.
- No training on customer data as the contractual default, not an opt-out buried in settings.
- A hard line between systems that read and agents that act, with human decision points wherever that line is crossed.
- Tamper-evident audit in the base tier of every product. Accountability should not be an enterprise add-on.
- Plain language about certifications: state the stage, claim nothing early. A named stage is worth more than a vague badge.
Security in this category is not a feature list. It is the architecture chosen before the first customer and the paper trail you can produce afterward. That is the standard we build Naxis against, and the one worth demanding from anyone who asks to read your company's documents.
