Data & AI platform by Data Analytics

A secure AI platform requires concrete agreements

When selecting an AI platform, the question is not simply which functions are available. You need to know who may use which information, what happens during processing and who intervenes when something deviates from expectations. Security comes from a combination of technology, configuration and day-to-day management. Assess your intended way of working rather than relying solely on a general product promise. Data Analytics helps make these choices concrete.

The examples on this page are hypothetical situations, not customer cases.

Meet our team

At Data Analytics

Start with users and groups

First identify which employees, teams and any external users need the platform. Connect access to tasks and responsibilities rather than convenience or historical habits. A temporary project employee may need different permissions from a permanent controller. Also establish who requests, reviews and arranges new access.

Groups can help treat comparable roles consistently, provided membership stays current. Agree what happens when people join, change roles or leave. Review periodically whether access is still required. During selection, ask how your intended structure is technically supported and which aspects require additional arrangements.

Separate data permissions from AI use

Permission to open an AI application does not automatically mean permission to consult all connected data. Distinguish access to the application, access to sources and permitted actions. The latter may include reading, analysing or sharing. Assess these layers separately before bringing them together in a workflow.

Example: a sales team may view its own customer information, while a finance team needs broader margin data. A shared AI interface must not inadvertently remove that distinction. Include such situations in acceptance testing. Also check what users can infer through summaries or combined answers about data to which access should be restricted.

Examine data processing and model choice

Ask which information is sent to a model and which parties are involved. Processing by external models depends on the selected model and setup. Examine retention periods, applicable agreements and any further processing. Do not base selection on an unverified assumption that business data always remains within one environment.

A local LLM and a connection through MCP to external AI are different choices. A local model concerns where the model runs; MCP describes a way for an AI application to work with data or tools. You must assess the actual data flow separately. For the private platform approach, see the existing page.

Make logging and monitoring purposeful

Determine which events you need to reconstruct: access, permission changes, source usage or other relevant actions. Then investigate which logging is available and what additional measures are needed. Recording more is not automatically better. Logs may contain sensitive information themselves and therefore also require access rules and appropriate retention periods.

Monitoring only has value when someone reviews signals and can act on them. Define which deviations need attention, who receives notifications and how follow-up is recorded. Example: unexpected use outside an agreed user group may warrant investigation. That signal alone does not prove that misuse has occurred.

Select for practical manageability

Ask suppliers to work through your own use cases rather than only providing a general demonstration. Test restricted access, changed roles and inappropriate requests. Ask which measures are standard, which require configuration and which responsibilities remain with your organisation. This gives a more realistic picture of the setup required.

ENABLE is the Data & AI platform from Data Analytics for connected, structured business data and controlled access for dashboards, analysis, apps and AI. Data Analytics supports setup and management. Explicitly discuss your intended governance, checks and operational responsibilities. Selecting a platform does not replace your own risk assessment or review of applicable obligations.

Frequently asked questions

Can a platform guarantee absolute security?

No. Assess specific risks, measures and remaining uncertainties. User behaviour, source permissions and management also affect the outcome. Ask about responsibilities and procedures for changes and incidents, not just technology.

Is logging the same as reviewing answers?

No. Logging can help reconstruct events, depending on what is recorded. Reviewing content also requires checks on accuracy, suitability and use. Determine which human review remains necessary for each application.

Who should own AI governance?

Appoint a clear owner, while involving process owners, IT and relevant specialists. They assess different aspects. Document who approves use, who manages data permissions and who reassesses the situation when changes occur.

Where should we start a practical selection?

Describe one application, including users, data, permitted actions and unwanted outcomes. Use that description as an evaluation framework. This lets you discuss demonstrable configuration and management rather than general security claims alone.

Discuss your question with Data Analytics

Which sources, users and checks does your application need? Discuss your question in an ENABLE demo.