Identity and access
Define who or what may read a message, use a field, invoke a Companion, approve an action, or change configuration.
Security by operating context
Every Inbox enforces the conditions for its own business risk.
Security is not one global switch. Each Inbox governs a defined flow of business messages with its own data contracts, access, purposes, actions, approvals, retention and AI conditions. The result is precise control where the work happens, with evidence that can support security and regulatory accountability.
Per-Inbox policyControlled AI accessTraceable decisions
One platform, precise boundaries
Security logic follows the Inbox, not a generic role matrix.
Every Inbox belongs to a project and has its own configuration, settings, reusable templates, and traceable business-message records. This lets a Customer Inbox protect consent and identity differently from a Finance, Agent or Workflow Inbox, while all remain part of one governed runtime.
Data and purpose
Bind schemas, sources, classifications, consent, purpose and permitted use to the operating context where they belong.
Actions and approvals
Allow, reject, route, redact, escalate or require human approval according to the message and its business risk.
AI and Companions
Control which external capability may receive which context, for what task, through which approved provider or private endpoint.
Retention and evidence
Set retention and deletion conditions and preserve the message, policy decision, AI involvement, approval and outcome needed for review.
Residency and deployment
Match the runtime, data location and infrastructure model to organisational, contractual and regulatory requirements.
NIS2
Operationalise cyber risk measures where work happens
NIS2 calls for appropriate and proportionate technical, operational and organisational risk measures. Per-Inbox policy helps translate that broad requirement into access rules, incident paths, supplier restrictions, continuity choices, change controls and traceable evidence for a defined operation.
- Risk-based access and handling
- Incident and escalation paths
- Supplier and Companion restrictions
- Configuration and decision evidence
EU AI Act
Make AI conditions visible and enforceable
AI Act duties depend on the system, role and risk category. An Inbox can preserve intended purpose, permitted data, model or provider eligibility, human oversight, logging and result handling around each AI-enabled process. That creates operational evidence for a wider compliance programme.
- Intended purpose and context
- Logging and traceability
- Human oversight conditions
- Accuracy, robustness and security controls
These controls can support a compliance programme. They do not replace risk assessment, legal interpretation, organisational measures, contracts, incident procedures or independent assurance.
Controlled change
Policy should change predictably.
DataInbox configuration can be inspected and validated before it is applied. That creates a safer path from policy intent to runtime behaviour and gives reviewers a clear boundary for each change.
- 01
Define
Model the messages, fields, identities, purposes, roles, actions and exceptions for one operating context.
- 02
Validate
Check configuration and templates before they can become part of the runtime.
- 03
Compare
Review the intended change and its scope instead of replacing policy as an opaque update.
- 04
Dry-run
Test the proposed configuration against the expected operation before applying it.
- 05
Apply and evidence
Activate the approved configuration and retain traceable message and decision records.
Infrastructure choice
Place the runtime where your policy requires it.
The current managed SaaS runtime configuration is hosted on DigitalOcean. Deployment can also be designed around selected data-centres, regions or customer-controlled infrastructure, based on the agreed architecture, operational model and service scope.
Deployment is part of policy
Managed SaaS on DigitalOcean
Selected data-centre or region
Customer-controlled infrastructure
Private or local AI endpoints
Security FAQ
Clear claims, configurable controls.
Does every Inbox have its own security policy?
Every Inbox is a configuration and policy boundary for a specific operating context. It can have its own schemas, permissions, allowed sources, actions, approvals, retention conditions and Companion eligibility. Shared platform and infrastructure controls still apply underneath it.
Does DataInbox make an organisation NIS2 or AI Act compliant?
No product creates compliance by itself. DataInbox provides configurable controls and operational evidence that can support NIS2, AI Act, GDPR and internal policy requirements. Applicability and compliance depend on the organisation, use case, configuration, contracts, procedures and legal assessment.
Where does the managed SaaS runtime run?
The current managed SaaS runtime configuration is hosted on DigitalOcean. Other deployment arrangements can be designed around selected data-centres, regions or customer-controlled infrastructure, subject to the agreed architecture and service scope.
Can sensitive AI work use a private model?
An Inbox can restrict AI work to approved Companions and permitted fields. A private or local AI endpoint can be selected for sensitive tasks when that endpoint and deployment are part of the approved architecture.