Trust.

Your knowledge is fully separated from every other customer's, at every layer. Each tenant has its own dedicated retrieval space, and your data carries database row-level security tied to your tenant identity — content is reachable only within your own tenant, by construction, not by a filter that could be left off.

Source-side access controls travel with your content: the permissions from Google Drive, Confluence, Slack, and every other connected tool are honored on every result, at the same layer as tenant identity.

That separation is continuously verified — the boundary between tenants is checked on an ongoing basis so it holds, always.

Sign in with your own identity provider over single sign-on (SAML or OIDC). People authenticate through the directory you already run, and sensitive administrative actions require step-up multi-factor protection. Administrative access uses per-operator identity — there is no shared admin key.

Every credential is stored only in hashed form, never in readable text. The plaintext is shown exactly once at issuance and is never written to logs or audit records. Programmatic access uses scoped tokens, each rate-limited and budget-capped.

People see only what they're already allowed to see, so two employees with different roles in the same company get results filtered to exactly the documents they have standing access to at the source.

Administrators set access policies for their own company: maximum active and idle session age, IP allowlists, and caps on how many credentials each person and team can hold. Policies belong to your company alone — there is no cross-tenant inheritance or default fall-through.

Enforcement is fail-closed. An expired session, a request from outside the IP allowlist, or a credential request beyond the configured caps is denied — and every denial is paired with an audit entry the admin can inspect.

When a person leaves, offboarding is instant and complete: every session, token, and service account they hold is removed in one step. It's all-or-nothing — if anything can't complete, the whole operation rolls back so the admin can retry cleanly, never leaving access half-removed.

Offboarding can be triggered automatically from your HR system over a signed connection, or manually by an admin in the dashboard. Every removal is recorded in the audit trail, so the full record of who was offboarded and when is visible to admins and procurement reviewers.

Every sign-in, configuration change, credential issued or revoked, query, and offboarding action is recorded in a complete audit trail. The trail is hash-chained, so any change to a past record is detectable — the record can't be quietly altered after the fact.

Each answer is traceable to the sources that informed it, so when a removal request lands, the team can confirm exactly what surfaced that content and where it was cited.

Admins review the audit trail directly from the dashboard and export it for procurement and compliance teams. Retention is configurable, with long-term retention for Enterprise, and the trail can stream to your own security tooling.

Per-customer encryption. Each customer's content is encrypted with its own AES-256-GCM data key, which is itself protected by a dedicated AWS KMS key unique to that customer. One customer's key can never decrypt another customer's content. Data in transit is protected with TLS 1.2+.

Bring your own key (Enterprise). Provide a KMS key in your own AWS account. Your content's key is protected under your key, so access depends on a grant you control — revoke it at any time to instantly and unilaterally cut off access. Quelvio cannot decrypt your content without your key, even if compelled.

Pick your region at signup — Global, Europe (EU), or Americas (US) — and your data stays there. Your content, the index built from it, and your audit trail all live on infrastructure in your chosen region, and AI processing follows your region too.

Your region is fixed for the life of your tenant, so your data stays exactly where you chose it — no accidental movement from a misconfiguration. The details are described in the data residency policy.

Deletion that survives backups. Each customer's content is sealed under its own key. When you erase, we destroy that key — rendering every copy (live data, database point-in-time backups, snapshots, and stored file versions) permanently unreadable, without waiting for backups to age out.

What erasure keeps. Erasure destroys your content and its keys. We retain the minimal billing and audit records the law requires us to keep (invoicing, tax, and the security audit trail) — these contain no document content. This balances your right to erasure (GDPR Article 17) with our legal retention obligations.

Source-driven deletion. When a document is removed in Google Drive, Confluence, or another connected source, it disappears from results immediately, with a full permanent purge shortly after.

Your data is continuously backed up with point-in-time recovery covering the last 7 days, plus automated encrypted snapshots. Stored files are versioned, with prior versions retained for 90 days so accidental deletions can be recovered. The database runs across multiple availability zones with automatic failover. All backups are encrypted with AWS KMS and stay in your chosen region — they never leave it.