"Caveau" is French for vault — and that's the design intent. caveauAI is built so the documents you give it never leave the boundary you put them in. No cross-tenant access. No training on your data. EU hosting by default. Sovereign deployment when you need it.
These are the operational commitments behind caveauAI. They apply across SaaS, private cloud, and sovereign deployments unless explicitly varied by contract.
Every customer corpus is stored in its own logical partition with separate access keys, separate retrieval scope, and separate audit trails.
caveauAI shared SaaS runs in EU bare-metal datacenters. Private cloud and sovereign deployments can run anywhere you require.
All traffic to and from caveauAI is over TLS 1.2+. Stored vectors, documents, and metadata are encrypted at rest.
Role-based access control governs who can read which corpora, who can ingest, and who can administer the workspace.
Every generated answer carries the source chunk it was grounded in. Reviewers can verify before acting; auditors can replay the retrieval.
You choose which model providers are permitted for your tenant. Defaults err on the side of provider transparency.
Some deployments cannot tolerate persistence at all. caveauAI supports stricter postures by configuration, not by hope.
For sessions where persistence is itself a risk — the Do Better Norge advocacy tools, for example — caveauAI can run in zero-retention mode. Uploaded documents and transcripts live only in the active session and are discarded immediately afterwards. No row, no object, no cache.
tools.dobetternorge.no runs zero-retention against a shared, read-only corpus of Norwegian tribunal and ECHR decisions. Family case material is never written to disk and never enters the shared corpus.
Blue Note Logic does not use customer corpus content to train, fine-tune, or evaluate any model. This applies across SaaS, private cloud, and sovereign deployments. Fine-tuning on customer data only happens when a customer explicitly contracts for it.
caveauAI is engineered for trust, but Blue Note Logic does not currently hold SOC 2 Type II, ISO 27001, or sector-specific certifications. We are happy to walk a security review through the architecture, controls, and operational practices that underpin the commitments above.
For regulated industries, the recommended path is a sovereign or private-cloud deployment scoped against your specific compliance framework. Get in touch and we will pair you with an engineer for a technical review.
Blue Note Logic will share architecture diagrams, access control specifications, and an operational runbook tailored to your review process.
