Updated on 26 October 2026
One instance per company, one base per instance
IntraIA is not a shared platform where every client's data sits together in the same database. Each company has its own instance: its server, its database, its settings, its accounts. None can read anything belonging to another, for a simple reason: nothing connects them.
This isolation isn't a setting, it follows from the architecture. Compromising several clients' data would mean compromising each server, one by one.
The index and the search stay on the machine
When you connect a documentation source or upload a procedure, IntraIA splits it up and indexes it for plain-language search. This work happens on your instance, through a semantic analysis engine installed locally. Your documents are not sent off to a third-party service to be analysed, and nothing goes to an AI provider to build the index: thousands of knowledge passages are split and stored on site, without a single line leaving.
What goes to the AI provider, and nothing else
When a team member asks a question, the instance searches the local index first, then sends the configured AI provider the question and only the extracts needed for the answer. Not the whole knowledge base, not the full document. Today that provider is Anthropic, whose API does not use the data sent to train its models.
That provider is not carved into the product: you change it in the admin area, and the product can talk to a model installed on your own premises, in which case nothing leaves the company at all. We have not put that into service for drafting yet, and we advise waiting: hardware able to run a good model still costs a lot for what it gives back, and the API remains, as things stand, the sensible choice. We are not sovereignty maximalists, more pragmatists. The day going local makes economic sense, we will support it.
The relay to vendor support follows the same caution. When a request goes off to ACD or Silae, the assistant strips out your clients' names and any sensitive data before sending. And you read the message over before it leaves: nothing leaves the instance without a human action.
Who sees what: rights, profiles, a separate portal
Not everyone sees everything. Rights are set by profile or person by person, and the menus, the home page blocks and the functions change with the role. A profile is internal or external: an outside contributor, a service provider, a partner only gets into their own menus and appears as such in the team. A team member only sees the files in their scope, and the assistant itself only searches what that person is entitled to see.
Your company's clients never enter the internal space. Their portal is a world of its own: their files, their exchanges, nothing else. They are served neither the staff directory, nor the knowledge base, nor the tools.
Everyday technical tasks
The rest is basic hygiene, and we keep to it. Everything runs over HTTPS. Passwords are hashed with argon2, sessions live in cookies that page scripts cannot reach. Every server we administer is backed up nightly at 3.30am, with fourteen days of retention, and each archive is checked right after it is written: an unreadable backup flags itself that same night, rather than being discovered the day you need it.
Everyone sees their connected devices in their profile and can log out the others; the admin area logs an account out of all its devices in one move, a lost phone, someone leaving. A session lasts thirty days and is extended with use.
Hosting: with us or with you
A dedicated private server that we supply and administer, or your own infrastructure if your internal policy requires it. The price stays the same. In the second case, your data only leaves your walls for the generation of the answers, under the conditions described above.
Today, the standard instance is a cloud server at Hetzner, in Germany or Finland: 4 cores, 8 GB of memory, 80 GB of disk, one machine per company, backed up every night. This is not a cloud shared with your neighbours. If you grow, we move to a bigger machine before things get tight: one step up, we absorb it; beyond that, only the difference in hosting is passed on, at cost. The software and the IntraIA price are not indexed to that size. On your own premises, you need a comparable machine: 4 cores, 8 GB and 80 GB as a minimum for the core platform, more for a local writing model.
Always on this machine: your documents, the index, search, permissions, validation, and a large part of the processing, filing, finding the passage that matters, preparing a relay, saying "I don't know". What may leave: the question and only the useful extracts, purely to draft an answer. On a machine of this size, a local model is kept for search and small jobs; drafting locally calls for more hardware.
What we don't have yet
No ISO 27001 certification yet, no SOC 2 report, no external security audit to date. What we offer instead is an architecture simple enough to be understood and checked, and direct answers: ask your technical questions on a thirty-minute call, or write to us at bonjour@intraia.fr.
Not all the information in a client file is equal
A client record holds some things everyone can see and others not. Its identity, its directors and its software are open to the team and to the client themselves. Its invoicing and bank details, IBAN and direct debit mandate included, are only shown to people who have the right to manage clients, and never in the client area.
This filtering happens when reading and writing, not when displaying. A team member without that right simply does not receive those fields, and if they save the record, the values they never saw stay intact.
An organisation spread over several cities adds another level: each client file carries the office that handles it, and lists can be filtered by office. Useful when several sites share a single platform and each one must only see what concerns it.
