AI security and compliance – GDPR, on-premise

Our clients trust us with their processes

Three deployment models. You decide.

Most enterprise AI solutions are in fact a front end placed on a US cloud API — the question, the document and the customer data all leave the company. With us the deployment model is your decision, not ours.

On-premise

The entire system runs on the company's own infrastructure, with an open-weight language model (for example Llama or Mistral) on your own GPU server. It works on a closed network too. Not a single byte leaves the company — not the question, not the answer, not the document.

Private cloud

A dedicated virtual environment (VMware, Kubernetes or a dedicated EU private cloud) under the company's control. A good choice when there is no in-house GPU capacity but the data must not go to a public cloud.

Hybrid

Sensitive data and processing stay on site, less critical components run in an EU cloud. We draw the line together — based on a data asset map, not on guesswork.

Which one is right for you? This is not a matter of belief but of assessment: two weeks of reviewing your data protection and infrastructure situation will tell.

What happens to the question you ask?

For enterprise AI this is the most important question, and most vendors do not answer it. We do:

The employee's question reaches the system over an encrypted channel (TLS 1.3).

The system retrieves the relevant sources from the company's own knowledge base — by permission: everyone only receives what they would be allowed to see anyway.

The language model runs in the location matching the chosen deployment model — on the company's own server in the on-premise case.

Every question and answer pair is logged: timestamp, user, sources used. Auditable, traceable, and it never leaves the system.

The model does not learn from your data. We commit to this contractually, and with on-premise deployment it is architecturally guaranteed: the model never reaches the outside world.

GDPR — not a slogan but a document pack

Data processing agreement (DPA) under Article 28 GDPR, for every deployment. On request we send the template as early as the proposal stage.
Data processing in the EU — including where a cloud component is involved; with on-premise deployment the data does not leave the company at all.
Configurable retention periods: conversations 90 days, audit log 12 months, aligned to your own data retention policy.
Support for data subject rights: erasure and access requests can be executed technically, not only on paper.
We know and follow the practice of the Hungarian Data Protection Authority (NAIH) — we design for the Hungarian legal environment rather than translating it in afterwards.

Adatvédelem és megfelelőség - vállalati csapat

EU AI Act — ready, not retrofitted

In 2026 the AI Act is no longer future tense. For every deployment we produce the system's risk classification documentation and supply what is needed to meet the transparency obligations (Article 50): the user knows they are talking to an AI, and answers are traceable with source references.

Internal enterprise assistant use cases typically fall into the limited-risk category — but we do not simply assert this, we derive it in documented form, use case by use case. If your legal team wants to go deeper, we are glad to sit down with them. This is a conversation we seek out, not one we avoid.

Enterprise controls

Sign-in with your existing directory: SSO / Active Directory / Entra ID integráció
Role-based access control — knowledge base access follows your organisational permissions
Encryption in transit (TLS 1.3) and at rest (AES-256)
Two-factor authentication on administrator accounts
Full audit trail, in exportable format
Incident response protocol with a 72-hour notification commitment

R-Szoft AI-ügynök irányítópult (dashboard)

For the IT security team

We know that at your company a rollout starts with a questionnaire. Good news: for us that is not an obstacle, it is home ground.

Send us your vendor security questionnaire — we return it completed within 5 working days.
DPA template and technical architecture description on request, under NDA, in the very first round.
A technical deep-dive interview with our engineering team, without commercial packaging.

Let's talk specifics.

30 minutes, with technical questions:

Request a technical consultation

AI that does not take your data out of the company