Security for your AI employees and their data
AlloTech.AI runs on a modern SaaS stack built for Quebec and Canadian SMBs. TLS 1.3 in transit, AES-256 at rest, isolated tenant networks, RBAC, approval gates by default, and optional full self-hosting.
Security foundations
Encryption in transit and at rest
Every connection uses TLS 1.3 with HSTS. Data at rest in PostgreSQL, Redis, and Qdrant is encrypted with AES-256. Backups are encrypted with a separate key before leaving the server.
Isolated tenant networks
Each customer runs in logically separated containers connected through isolated Docker networks. One tenant cannot access another tenant's data, memory, or vector store.
RBAC and least privilege
Role-based access control, secure authentication, API-key scoping, and optional mandatory MFA for Enterprise accounts. Administrators control exactly what each AI employee can read or write.
Approval gates by default
Real-world actions stop at an approval gate until a human validates them. Full autonomous mode is opt-in, per employee. Every approval and rejection is written to an immutable audit log.
Hosting and deployment options
Application and databases hosted in Canada, or run everything on your own infrastructure.
Canadian SaaS hosting
By default, the FastAPI backend, Next.js frontend, PostgreSQL, Redis, and Qdrant vector store are hosted on Canadian infrastructure. Language models: cloud providers, plus Ollama models hosted on our servers. Text sent to a cloud provider may be processed outside Canada; the Privacy Policy lists the providers and what is masked (names are not).
Enterprise self-hosting
For Enterprise customers, we deploy inside your environment with Ollama for local inference. Your data never leaves your network, giving you full sovereignty and simplified Law 25 compliance.
Reason → gate → act
The loop every AI employee follows. This is why you can let an agent propose work without worrying it will act on its own.
1. Reason
The employee analyzes the request, searches its memory and your RAG documents, and decides which action to propose. Zero real-world effect at this step.
2. Gate
The proposed action stops. You see what the employee intends to do, why, and on which data. Approve, modify, or refuse in one click.
3. Act
Once approved, the action executes and is logged in the audit trail — full traceability for compliance and incident review.
Vulnerability management and compliance
Security is a continuous process, not a one-time checklist.
Regular assessments
We run vulnerability scans, dependency checks, and code reviews. Security patches are prioritized and deployed quickly.
Audit-ready logs
Account administrators can export audit logs and compliance reports. Enterprise customers can request security attestations.
Law 25 built in
Incident register, data inventory, consent tracking, and breach notification workflows are included in every plan.
Where your data is processed
Databases and vector search stay on our servers in Canada. Text sent to language-model providers can be processed outside Canada (see the Privacy Policy). Enterprise plans can self-host models with their own key.
Ready to deploy a secure AI employee?
Start free for 7 days, or talk to us about a sovereign Enterprise deployment.
What Law 25 requires, step by step: Law 25 explained for SMBs.