SECURITY & GOVERNANCE

AI with rules.
Your data stays yours.

KYRONIQ was designed for businesses that can't leave AI uncontrolled: identity from your organization, role-based permissions, human approvals and a full audit — in the cloud or on-premise.

Request a demoDeployment options
SSO & MFARBACApprovalsAuditOn-premise

PRINCIPLES

Six layers of control on every request

Security is not an add-on. It's how the AI Orchestrator decides what happens.

01

Identity & SSO

Sign-in with Entra ID or Active Directory, SSO and MFA. Users, groups and hierarchy come from your organization.

02

Role-based permissions (RBAC)

Who sees which module, which connector and which data — per role, department and group company.

03

Source permissions

The assistant only sees what the user already sees in Microsoft 365, the ERP or the files. It creates no new access.

04

Human approvals

Actions that change data or settings go through approval, with limits per role and per system.

05

Full audit

Every request, answer, tool call and approval is logged: who, when, with which data and with which model.

06

Model control

You define which models are allowed for which data. Sensitive data is routed to local models, without leaving the network.

DATA FLOW

What happens on every request

Before any model answers, the Orchestrator checks who is asking, what data is involved and what is allowed.

  1. User and role identification
  2. Data sensitivity classification
  3. Policy-based model selection
  4. Approval for actions, logging for everything
Audit logLIVE
m.papadopoulou · FinanceALLOWED
Data: ERP sales · Sensitivity: internalCLOUD MODEL
k.georgiou · HRALLOWED
Data: performance reviews · Sensitivity: personalLOCAL MODEL
it-agent · Active DirectoryAWAITING APPROVAL
Action: password reset · Approver: IT administratorLOGGED

DEPLOYMENT

You choose where your data lives

On-premise

The platform, the database and the local models run on your own servers. No data leaves the network unless you allow it.

  • Full control of the infrastructure
  • Works even without internet using local models

Cloud

An isolated environment exclusively for your company, with no data shared with other customers, with updates and backups handled by us.

  • Fast start, no infrastructure
  • Same rules, roles and audit

USER ADMINISTRATION

Users, roles and identity in one place

The administrator decides who gets in, where they come from and what they may see and do — with every change recorded.

Users and identity source

Users and identity source

Local users, AD/LDAP or Entra ID, with source filters and sync status.

Invite or import from the directory

Invite or import from the directory

An email invitation or a user from an approved company source, with no duplicate accounts.

Profiles with synced fields

Profiles with synced fields

Directory data is read-only; KYRONIQ settings stay local.

Roles and permissions

Roles and permissions

Permissions per function and data, AD/Entra group-to-role mapping, least privilege, audit and protection of the last administrator.

FREQUENTLY ASKED QUESTIONS

What IT teams and DPOs usually ask

Is our data used to train models?

No. With local models, data never leaves your network. With cloud models, business APIs are used under terms that do not allow training on customer data, and you choose which data may be sent.

Where is the platform hosted?

Wherever you choose: on-premise on your own servers, or in an isolated cloud environment exclusively for your company. The functionality is the same.

Can the AI make changes without us knowing?

No. Connectors are read-only by default. Actions are enabled explicitly per system and role and, wherever you set it, require approval. Everything is logged in the audit.

How does it help with GDPR and EU AI Act compliance?

It gives you a central register of AI uses, policies per data category, human oversight through approvals and a full trace — the evidence needed for documentation and audits.

What happens when a user leaves the company?

Access follows Entra ID / Active Directory. As soon as the account is disabled, access to KYRONIQ is lost too.

See KYRONIQ working with your own systems.

A 30-minute demo built around your own scenarios. No commitment.

Request a demoContact