Trust.

Your knowledge is fully separated from every other customer's, at every layer. Each tenant has its own dedicated retrieval space, and your data carries database row-level security tied to your tenant identity — content is reachable only within your own tenant, by construction, not by a filter that could be left off.

Source-side access controls travel with your content: the permissions from Google Drive, Confluence, Slack, and every other connected tool are honored on every result, at the same layer as tenant identity.

That separation is continuously verified — the boundary between tenants is checked on an ongoing basis so it holds, always.

Sign in with your own identity provider over single sign-on (SAML or OIDC). People authenticate through the directory you already run, and sensitive administrative actions require step-up multi-factor protection. Administrative access uses per-operator identity — there is no shared admin key.

Every credential is stored only in hashed form, never in readable text. The plaintext is shown exactly once at issuance and is never written to logs or audit records. Programmatic access uses scoped tokens, each rate-limited and budget-capped.

People see only what they're already allowed to see, so two employees with different roles in the same company get results filtered to exactly the documents they have standing access to at the source.

Administrators set access policies for their own company: maximum active and idle session age, IP allowlists, and caps on how many credentials each person and team can hold. Policies belong to your company alone — there is no cross-tenant inheritance or default fall-through.

Enforcement is fail-closed. An expired session, a request from outside the IP allowlist, or a credential request beyond the configured caps is denied — and every denial is paired with an audit entry the admin can inspect.

When a person leaves, offboarding is instant and complete: every session, token, and service account they hold is removed in one step. It's all-or-nothing — if anything can't complete, the whole operation rolls back so the admin can retry cleanly, never leaving access half-removed.

Offboarding can be triggered automatically from your HR system over a signed connection, or manually by an admin in the dashboard. Every removal is recorded in the audit trail, so the full record of who was offboarded and when is visible to admins and procurement reviewers.

Every sign-in, configuration change, credential issued or revoked, query, and offboarding action is recorded in a complete audit trail. The trail is hash-chained, so any change to a past record is detectable — the record can't be quietly altered after the fact.

Each answer is traceable to the sources that informed it, so when a removal request lands, the team can confirm exactly what surfaced that content and where it was cited.

Admins review the audit trail directly from the dashboard and export it for procurement and compliance teams. Retention is configurable, with long-term retention for Enterprise, and the trail can stream to your own security tooling.

Encryption at rest. How each customer's content is encrypted at rest, and where its keys are kept, is set when Quelvio's service is hosted; it will be named here. Data in transit is protected with TLS 1.2+.

Bring your own key (Enterprise). How you bring your own key is set when Quelvio's service is hosted; it will be named here.

Your content, and the index built from it, are stored only in your own storage, in the region you choose for it.

Some processing happens in the United States: the privacy policy's Section 6 lists each provider and where it processes.

Deletion that survives backups. How erasure reaches every copy of your content, backups included, is set when Quelvio's service is hosted; it will be named here.

What erasure keeps. Erasure destroys your content and its keys. We retain the minimal billing and audit records the law requires us to keep (invoicing, tax, and the security audit trail) — these contain no document content. This balances your right to erasure (GDPR Article 17) with our legal retention obligations.

Source-driven deletion. When a document is removed in Google Drive, Confluence, or another connected source, it disappears from results immediately, with a full permanent purge shortly after.

How your data is backed up, and where the backups are kept, is set when Quelvio's service is hosted; it will be named here.