Security
Where client data stays
For a bank, a public body or a law firm, this question comes before any capability — and vague answers to it are themselves an answer.
5 min read
Two questions that get conflated
“Is our data secure?” and “where is our data?” are different questions with different answers. The first is about encryption, access and auditing. The second is legal and contractual, and it is usually the one that decides the purchase.
If you have a written obligation that client data must not leave your network, no amount of encryption in someone else's cloud satisfies it. That has to be established in the first meeting.
The real difference
Hosted versus self-hosted
| Hosted | Your own servers | |
|---|---|---|
| Where client data sits | Infrastructure inside Iran | Your own network |
| Outbound connections | For model processing | None — the licence verifies offline |
| Language model | An external service | Can sit inside the network |
| Updates | Automatic | On your schedule |
| Maintenance | Ours | Your engineering team's |
Before signing
Six questions to ask
Of any vendor, including us. A vague answer to any of them is itself an answer.
- Which server, in which country, does my data physically sit on?
- Self-hosted, does the software need internet access to run?
- What data leaves for AI processing?
- Is there a ledger of those calls that I can see myself?
- How do I export all my data, and in what format?
- When the contract ends, what happens to my data and when is it deleted?
Our answer
Self-hosting is a first-class option rather than an expensive exception: four containers and one volume. The licence verifies offline and the software makes no outbound connection to run — if you want to connect an external language model, that is a separate and optional link.
Hosted, the infrastructure is inside Iran, and the AI usage ledger shows what text went out for processing.
And honestly: if you have no written obligation and are choosing self-hosted because it “feels safer”, cost it properly — a server somebody maintains, updates somebody applies, and backups somebody tests. In most teams of 5 to 50, those land on a person who does not have the time.
Common questions
What does “nothing phones home” actually mean?
It means that self-hosted, the software sends no request outside your network for normal operation, and the licence check happens offline. The only optional connection is an external language model, which you decide whether to enable.What happens to the data after the contract ends?
Self-hosted, the data was on your own server from the start and stays there. For the hosted case, retention and deletion terms are in the data processing addendum.
Try it on your own data
The free plan has no time limit. Bring the hardest document you have.