Security, privacy, and what this demo actually is
This page is written for someone about to ask us hard questions in a procurement review. It states what is true of this demo site, and separately what is true of a customer deployment, because they are not the same thing.
This demo contains only synthetic data
Every call, transcript, label, figure, and voice on this site was generated for demonstration. There is no real recording, no real customer, no real person, and no personal data of any kind in the demo dataset. Names, companies, estates, and house models are invented and drawn from a fixed, published list.
This is enforced, not merely intended. Before anything is published, an automated gate scans the material that will actually ship — transcripts, labels, entity names, prepared answers, every quoted passage — for personal-data patterns and for any identity outside the published list. If the scan finds anything, publication stops. The gate itself is verified by a test that plants realistic personal details into a copy and requires the gate to catch them.
The demo is separated from every customer environment
- Its database is a separate instance with its own credentials, shared with nothing.
- Its configuration is checked at release time: a production or customer credential, or a connection pointed at anything other than the demo’s own host, blocks publication.
- The application refuses to start if it is configured against a database host nobody explicitly allowed.
- There is no network path, and no data path in either direction, to a customer environment.
Where this demo is hosted, and why that is acceptable here
This demonstration site is not hosted in the European Union, and the model services it can reach are the non-European defaults. We do not control the platform’s region.
That is acceptable for this site and only for this site, because the content is synthetic: there is no personal data to reside anywhere. It is emphatically not the posture we propose for your recordings. A customer deployment is self-hosted in a region you choose, with transcription, analysis, embedding, and re-ranking pointed at self-hosted or EU endpoints through the configuration centre — a change of preset, not a change of architecture.
The demo is read-only, and that is structural
- The published build exposes no address that creates, modifies, or deletes anything, and no upload address at all — not a disabled one, not a hidden one. A test enumerates the built route table and fails if a new address appears.
- Every request is re-checked on the server against the frozen read-only role and against the fixed set of sample calls. Anything a browser claims about its own permissions is ignored.
- Rate limits and a daily assistant allowance protect the site from being used as someone else’s tool.
- Attempts to write, upload, or exceed an allowance are refused and recorded.
What a customer deployment commits to
- Personal-data scrubbing before analysis. Phone numbers, e-mail addresses, PESEL, NIP, IBAN, names, and addresses are removed from the text before it reaches any model or any index — never after.
- Raw text is privileged. Viewing unscrubbed transcript requires a specific grant and is audited.
- Data subject requests. Records for an individual are located and deleted, including the derived pages, vectors, and graph edges.
- Retention. Twelve months by default, configurable, deleted automatically on expiry.
- Transport and storage. TLS 1.2+ in transit, AES-256 at rest, signed inbound requests and webhooks, rate limits, and an authenticating gateway in front of the workbench.
- Audit. Raw-text access, exports, configuration changes, role changes, and deletions are recorded in an append-only log.
Search results and assistant answers in this demo
Where the demo is running on prepared content rather than the live services, it says so on the screen. Assistant answers are composed from passages copied out of the sample transcripts, and every citation is re-checked against the transcript before it is shown — a citation that does not resolve means the answer is discarded, not displayed.