Your data security, in concrete terms

One instance per company, one base per instance

Intra IA is not a shared platform where every client's data sits in the same database. Each company has its own instance: its server, its database, its settings, its accounts. Three instances are running today, and none of them can read anything from another, for a simple reason: nothing connects them.

This isolation isn't a setting, it follows from the architecture. Compromising several clients' data would mean compromising each server, one by one.

The index and the search stay on the machine

When you connect a documentation source or upload a procedure, Intra IA splits it up and indexes it for plain-language search. That work happens on your instance, with a semantic analysis engine installed locally. Your documents are not sent off to a third-party service to be analysed, and nothing is sent to an AI provider to build the index: all 27,205 knowledge passages in our first firm instance were indexed on site.

What goes to the AI provider, and nothing else

When a team member asks a question, the instance searches the local index first, then sends the configured AI provider the question and only the extracts needed for the answer. Not the whole knowledge base, not the full document. Today that provider is Anthropic, whose API does not use the data sent to train its models.

That provider is not baked into the product. A model running on a machine at your premises can take its place today, and then nothing leaves the company at all. We still advise waiting: hardware able to run a good model is expensive for what it gives back, and the API remains, as things stand, the sensible choice. We are not sovereignty maximalists, more pragmatists. The day moving in-house makes economic sense, we will support the move.

The relay to vendor support follows the same caution. When a request goes off to ACD or Silae, the assistant strips out your clients' names and any sensitive data before sending. And you read the message over before it leaves: nothing leaves the instance without a human action.

Who sees what: rights, profiles, a separate portal

Not everyone sees everything. Fourteen permissions can be set by profile or one by one, and the menus, the home page blocks and the functions change with the role. A team member only sees the client files in their remit, and the assistant itself only searches what that person is entitled to see.

Your company's clients never enter the internal space. Their portal is a world of its own: their files, their exchanges, nothing else. They are served neither the staff directory, nor the knowledge base, nor the tools.

Everyday technical tasks

The rest is basic hygiene, and we keep to it. Everything runs over HTTPS. Passwords are hashed with argon2, sessions live in cookies that page scripts cannot reach. Every server we administer is backed up nightly at 3.30am, with fourteen days of retention, and each archive is checked right after it is written: an unreadable backup flags itself that same night, rather than being discovered the day you need it.

Hosting: with us or with you

A dedicated private server that we supply and administer, or your own infrastructure if your internal policy requires it. The price stays the same. In the second case, your data only leaves your walls for the generation of the answers, under the conditions described above.

What we don't have yet

Intra IA is a young product, and we would rather tell you here than let you find out: no ISO 27001 certification yet, no SOC 2 report, no external security audit to date. What we offer instead is an architecture simple enough to be understood and checked, and direct answers: ask your technical questions during a thirty-minute call, or write to us at bonjour@intraia.fr. A director who knows exactly where their data lives protects their company better than a logo they have never read.