Written for the person whose job is to say no
The due-diligence answers, up front. Where something is planned rather than shipped, it says so — that habit is the security posture.
How is our data isolated?
Structurally. Every organization is a fully isolated tenant: conversations, knowledge, configuration, and analytics are scoped at the platform's core. Isolation is architecture, not policy.
Who can access what?
Role-based access control with capability grants per role, enforced server-side on every request. Administrative surfaces are gated by role, not hidden by UI.
Is there an audit trail?
Every administrative action is logged and rendered in your tenant's own audit surface, in plain language, attributable to the acting identity — including platform operators.
What can your own operators do?
Observe and support — not silently modify. The operator model carries a deny-list: membership changes in your organization are refused at the platform level, even under support override. Every operator action lands in your audit log.
How is authentication handled?
Cookie-backed sessions with server-side verification on every request, middleware-enforced route protection, sanitized redirects, and session-expiry handling. Credentials never appear in URLs.
Where does the platform run?
Cloud today, on enterprise-grade infrastructure in hardened data centers. On-premises deployment is available for institutions with sovereignty requirements — in that model, your team operates the platform and Siliana has no standing access.
Do AI answers leak between customers?
No. Retrieval runs inside your tenant only. Your documents ground your AI employees and no one else's.
What about certifications?
Stated honestly: formal certifications (ISO 27001, SOC 2) are on the roadmap, not yet held. What exists today is the structural posture above — and we'd rather tell you that plainly than imply otherwise.
See your first AI employee answer for real
Book a demo: 30 minutes, your use case, the live product — honest scoping, no slideware.