Security and privacy overview
This page describes what Labtagon AI OS does with your data and what it protects. It gives the defaults; what your organisation has set, its administrators see under Control Panel → Settings.
What a model gets to see
Section titled “What a model gets to see”Every model call goes through the LLM gateway of AI OS: from the chat, from agents, from built-in capabilities and from your own tools with an API key. No part of AI OS calls a model provider around this gateway.
- Where to. Your organisation’s administrators choose under Control Panel → LLM providers which providers AI OS calls, and under Control Panel → Models which models you may use. OpenRouter, OpenAI and Anthropic are set up; any provider with an OpenAI-compatible address can be added.
- What. A model receives what belongs to the answer: your message, the chat so far, instructions and, when the model calls tools, their results.
- Models inside the installation are planned (ADR 0079). Today the models run at the providers that are set up.
What AI OS keeps
Section titled “What AI OS keeps”| What | Where and for how long |
|---|---|
| Your chats | In the AI OS database, until you delete them. |
| Model calls | Figures only: model, tokens, cost, duration, status and which kinds of personal data were found, not the text. |
| Full prompts | Only when the organisation switches on Keep prompts in a pipeline: all calls or a share of them, for at most 90 days, masked when masking is on. Only the organisation’s administrators may read them, and every read is in the audit log. |
| Contents of tool calls | Arguments and results are seen only by whoever made the call; 7 days by default, at most 90 (Keep tool call contents (days)). |
| History of tool calls | Who called what and when, without contents; 90 days by default (Keep the tool call history (days)). |
| Files | 7 days after they came in by default, unless you keep them (Keep files for (days)); stored encrypted, see below. |
| Audit log | 90 days by default, at least 7 (Retention in days). |
Masking personal data
Section titled “Masking personal data”The organisation can make sure personal data does not leave AI OS in plain text on its way to a model (setting Personal data in prompts to models, off by default):
- Mask: before the call, a checker (Presidio) reads every message. Each finding is replaced by a
placeholder such as
[NAME_1]; in the answer AI OS puts the real values back, also in tool calls the model returns. You read plain text, the model does not. - Refuse: a prompt with personal data does not go out.
- When the checker cannot be reached, the call is refused, not sent unchecked.
- Only the kinds of findings and their number are kept, never the values.
Good to know:
- Masking happens only on the way to the model. Your chat and an export contain what was written.
- The checker has to be set up in the installation. The standard checker reads English; a pipeline can have up to four languages checked.
- By default the checker skips dates, web addresses, places and nationality, religious or political group (NRP); the organisation can change that.
- Tool calls have a check of their own (Check tool calls for personal data, off by default). It does not mask: it notes findings or holds the call for approval.
When AI OS asks first
Section titled “When AI OS asks first”Every tool call of a client or an agent goes through the gateway of AI OS. It holds some calls until a person approves them:
- What a profile allows. In a profile you set for each tool server what a client may do with it: Read only, Read & write, Everything or single tools (Custom). A client cannot call what the profile does not allow.
- Tools that ask first. For an agent you set for each tool whether it asks you first (Asks you first). Such a call is always held.
- The organisation’s checks. Administrators can have calls checked by a safety model or by rules and choose which are held: those the check flags, and if they want also every call that deletes something or changes rights (Hold tool calls for approval). These checks are off by default.
A held call appears in your Inbox as a Held call. Only you decide on it; neither a rule nor a model approves it in your place. By default an approval lasts 60 minutes; an unanswered request expires after 24 hours. More in Tasks and approvals.
Keys and sign-ins
Section titled “Keys and sign-ins”- Tool servers usually do not see their keys. Their code works with placeholders. Only on the way out does the egress gateway fill in the real key or token, at the place the server declared and only for the hosts that belong to that service. The exception: a tool server can explicitly ask for a key as an environment variable; then its process gets it at start.
- Stored encrypted. Your sign-ins to other services and your keys are stored encrypted in the database, bound to your entry; only the egress gateway can open them. The credentials for the model providers are encrypted too; of your own API keys AI OS keeps only a hash. Files are encrypted before they go to the object store.
- Only allowed destinations. Tool servers reach the internet only through the egress gateway, and only the hosts approved for them; a tool server can also declare per host which requests it sends.
What is recorded
Section titled “What is recorded”AI OS keeps an audit log. It records, among other things, changes to settings, sign-ins and keys, files and shared pages, exports, approvals, reads of kept prompts, administrators viewing other people’s tool calls, and refused connections to the outside. The arguments of tool calls are not in the audit log.
Your own tool calls, model calls, events and holds are under Insights → Logs.
Where AI OS runs
Section titled “Where AI OS runs”- AI OS is installed with a Helm chart on a Kubernetes cluster. Whoever operates it decides where that cluster is.
- Inside the cluster every connection is denied unless it is allowed explicitly; the only way out for tool servers is the egress gateway.
- One installation can hold several organisations. Model providers and their credentials belong to one organisation each; an organisation’s shared tool servers run in a namespace of its own, a person’s own ones in theirs.
- You sign in through your organisation’s sign-in service (OpenID Connect). A console session lasts 10 hours by default. Clients such as Claude Code get tokens from AI OS that last 10 minutes and that they renew by themselves; after 30 days without use, and at the latest after 90 days, they sign in again.
- Code the chat runs, runs in an isolated sandbox (gVisor) when the installation has switched it on.
Dictation stays on your device
Section titled “Dictation stays on your device”When you dictate in the chat, your browser recognises the speech on your device. AI OS offers dictation only where that is possible; the recording goes neither to AI OS nor to a provider. Once, the browser downloads the language pack from its maker.
Policy frameworks
Section titled “Policy frameworks”Under Control Panel → Policy frameworks an organisation can adopt rule sets from law (GDPR, the EU AI Act for deployers, NIS2, the German Works Constitution Act BetrVG). A rule set sets minimum values for settings, asks for evidence and withholds models that do not meet its requirements. A rule set does not replace a legal review.