01
No training on your data
Aveya runs on Azure OpenAI. Under Microsoft’s terms, your prompts and completions aren’t used to train the underlying models.
Security & privacy
Governed AI, built for a real security review.
Tenant-scoped access, source-grounded answers and deployment controls, backed by architecture, data-flow and control detail available on request.
Security principles
A governed operating model.
02
Tenant scoping
Every retrieval is restricted to your tenant and workspace and fails closed. Access rules follow tenant boundaries across storage and search.
03
Data ownership
Your organisation controls its approved sources and how they are used within the deployment.
Data handling
Source to output, in four steps.
1 Source
Approved sources
Content enters only from the sources approved for the workspace.
2 Indexed
Indexed in place
Content is chunked and indexed within the deployment’s own resources.
3 Retrieved
Scoped retrieval
Relevant context is selected per request, scoped to your tenant and workspace.
4 Output
Cited answer
A cited answer is returned; in strict mode, unsupported answers are withheld.
What’s enforced
Controls that hold at runtime.
Not aspirations — behaviours the platform enforces today.
Fails-closed authentication
Aveya won’t start in production with unsafe auth configuration, and unauthenticated access is disabled.
Azure OpenAI in production
In production Aveya only runs against Azure OpenAI; the app refuses to start otherwise.
Scoped retrieval
Retrieval is restricted to the caller’s tenant and workspace; assistant scope fails closed.
Strict source-grounding
In strict mode, answers come only from authorised sources; unsupported questions get a clear refusal.
Role-based access
Sensitive operations are gated by role (user / admin / superadmin), with an additional demo-mode guard.
Encryption in transit & at rest
TLS in transit and encryption at rest on the Azure platform beneath the deployment.
Platform controls
Grouped by domain.
Identity & access
Authentication
SSO-compatible identity and role-based access.
Embedded access
Embedded experiences run under scoped, short-lived access.
Granular permissions
Document-level and fine-grained tool permissions are a roadmap item ahead of pilot rollouts — not yet available.
Data protection
Encryption
TLS in transit and encryption at rest on the Azure platform.
Tenant separation
Access rules follow tenant boundaries across storage and search.
Observability
Activity logging
Activity records support review and oversight but are not positioned as an immutable compliance audit log.
Retention
Captured events and retention depend on deployment and policy.
Deployment options
Two operating models.
Both run the same governed Aveya product, configured around your approved knowledge. Not built and hosted as a bespoke system for each deployment.
Aveya-managed deployment
An Aveya-operated environment with tenant separation and regional hosting controls.
- Aveya-operated environment
- Tenant separation and regional hosting controls
- No customer infrastructure ownership required
Deploy in your Azure tenant
For qualifying engagements, Aveya can run as an isolated stack in a customer-controlled Azure subscription, defined in infrastructure-as-code.
- Runs in a customer-controlled Azure subscription
- You control networking, policy and security tooling
- Suitable for high-control and regulated environments
Compliance approach
Built on Azure’s certified foundation.
Aveya runs on Azure services with established security and compliance programs.
Azure provides certified infrastructure controls beneath the platform.
We support enterprise security questionnaires and reviews.
A security review pack is available on request: architecture, data flow, control mapping and deployment detail.
◦ review-ready
Architecture
Overview included
Data flow
Boundary mapping
Security review pack
Control detail · available on request
supports your security questionnaire & review
Plan your security review.
We’ll align on your scope, deployment model and what your team needs for a practical review.