Security
Security: verifiable terms, not promises
Corporate AI runs in infrastructure agreed with you. Below is how data, access and oversight work, and what we put in the contract.
Request flow
What happens to each employee question
- 01The employee signs in with a corporate account (AD/LDAP, SSO).
- 02The platform checks their role and document permissions.
- 03The knowledge base search covers only documents the employee has access to.
- 04The model on dedicated servers prepares the answer.
- 05The answer is checked against the sources, and the links are shown to the employee.
- 06If an agent is needed, it gets access from the Access Vault; any action that requires confirmation waits for the employee.
- 07Everything is logged.
Security controls
How protection is built
| Area | How it works |
|---|---|
| Deployment | Your hardware, Flatstack infrastructure or another agreed setup; data stays in the client’s country; an air-gapped perimeter is possible |
| Models | Open models on dedicated servers; no public AI APIs; no training on company data |
| Access | Sign-in via AD/LDAP or SSO, MFA, roles; answers respect document permissions |
| Secrets | Vault: role-based access with approval, rotation, no passwords in requests to the model |
| Agent actions | An agent does only what is allowed; flagged actions wait for an employee to confirm |
| Logging | Actions of users, agents and administrators; agreed retention periods |
| Integrations | Read-only in the first phase; agent permissions are set explicitly |
| Support | Vendor access only under the contract, with your approval and logged |
| Ownership | We hand over the integration code, settings and agent workflows to the client; the exit plan is in the contract |
AI boundaries
You set the boundaries
You decide which actions an agent performs on its own and which only after an employee confirms them. By default, AI makes no legal, financial, HR or production decisions and does not control equipment.
Law and accountability
Legal requirements in the architecture, not in a slide deck
Russia — Federal Law 152-FZ on Personal Data
Personal data of Russian citizens is stored in Russia. Processing stays inside the agreed perimeter. Legal grounds, the parties’ roles and safeguards are agreed before the project starts.
Kazakhstan and Uzbekistan
Kazakhstan, Law No. 94-V: citizens’ personal data is kept on servers in Kazakhstan. Uzbekistan, Law ZRU-547: since 27 March 2026, mandatory localization applies to biometric, genetic and telecom-subscriber data.
AI regulation — Russian Federal Law 243-FZ
From 1 March 2027, AI system developers must meet requirements for security, operating rules and technical documentation. We build them in up front.
Critical-infrastructure, industry and certification requirements are assessed separately. Hosting in a given country does not by itself mean full compliance.
Documents
Documents and statuses
We show the status of each document. The number appears here once the document is issued, and you can check it in the public registry.
- Russian Software RegistryApplication in progress — the number will appear here once issued
- Certificates and licensesApplication in progress — the number will appear here once issued
Security team questions
Straight answers
Does data go to external AI services?
No. The model runs on dedicated servers; public AI APIs are not used.
Is the model trained on our data?
No. The knowledge base grows with verified answers; the model is not fine-tuned.
Who at Flatstack can access the system?
Only our support team, under the contract and with your approval, and every session is logged. Access is issued through the Vault and revoked once the work is done.
Where are logs stored, and for how long?
Inside your perimeter; the retention period is agreed before the start.
Can you complete our security questionnaire?
Yes — we’ll answer your security team’s questionnaire as part of the document pack.
First call: 30 minutes, online.
We’ll send the documents before our first meeting
Architecture and data flow diagram, a description of security controls, answers to your security questionnaire, the support access procedure and a draft confidentiality agreement.
We’ll sign an NDA before discussing any details.
Or contact us directly