AI and data
Where your data goes in AI models and managed services, who holds the keys, how test data is made, and the rules you must meet.
15 questions
Can the agents run without our data leaving our environment?
Yes. The agents, the tools and the models can run inside your own data centre or a private network on a regional sovereign cloud. Our sovereign LLM practice hosts the models there.
Read more: Multi-agent systems and protocolsLink to this question
Can the model run without any data leaving our country?
Yes. We host the model in an air-gapped environment, on your own servers or in a private network on a regional sovereign cloud. Prompts, documents and answers stay inside that boundary, and no third party trains on them.
Read more: Sovereign LLMs, SLMs and context platformsLink to this question
How do you stop the model showing people what they should not see?
Retrieval applies your row-level and role-level access rules before any text reaches the model. An answer is built only from content the person asking may read, using your existing identity and access rules.
Read more: Sovereign LLMs, SLMs and context platformsLink to this question
How much data do we need?
It depends on the decision and how much the data varies. We assess what you hold at the start and tell you plainly if it is enough. Where it is not, we say what to collect, or whether a simpler method will do.
Read more: Large quantitative models and applied MLLink to this question
How are recordings, messages and images protected?
They are processed only where you allow, which can be inside your own environment. Access is limited and logged, and personal data is masked where the task allows. Retention follows your rules.
Read more: Multimodal, speech and vision AILink to this question
How are our documents and data protected?
Documents can be processed inside your own environment, so they never leave it. Access is limited by role and logged, and KYC and personal data follow your retention rules.
Read more: Intelligent document processing (IDP 2.0)Link to this question
Where does our data go in a managed service?
Where you decide. Enterprise systems run inside your environment or a regional sovereign cloud, and no third party trains on your data. We agree the hosting and residency before anything is deployed.
Read more: Packaged AI tiers and managed AI servicesLink to this question
How do you handle access to production data?
Each engineer has a named account with only the permissions the task needs, granted for the duration of the work and logged. We work on masked or sample data wherever possible. Credentials stay in your secrets store, and every change to production follows your change process, with a rollback ready.
Read more: Data architecture, lakehouses and real-time pipelinesLink to this question
Who holds the encryption keys?
You do. Keys stay in a key store or hardware security module that you control. Our engineers use them only through the roles and procedures you approve, and no single person can export or delete keys alone.
Read more: Data governance, sovereignty, privacy and securityLink to this question
What is the difference between encryption, tokenisation and masking?
Encryption makes data unreadable without a key. Tokenisation replaces a value, such as a card number, with a token that means nothing outside a protected vault. Masking hides part or all of a value, often to create realistic test data.
Read more: Data governance, sovereignty, privacy and securityLink to this question
How do we get realistic test data without copying production?
We mask or tokenise copies of production data, or generate synthetic data that follows the same rules. Test data keeps the formats and edge cases your tests need without exposing real customers.
Read more: Data governance, sovereignty, privacy and securityLink to this question
Can you help us meet rules such as the GDPR and the PDPL?
Yes. We map where personal data is held and processed, protect it in proportion to the risk and document the decisions. We do not give legal advice: your legal team decides how the rules apply, and we work with them.
Read more: Data governance, sovereignty, privacy and securityLink to this question
Will users see data they should not?
No. The same row-level and role-level access rules apply to dashboards, reports and AI answers, so each user sees only what they may see.
Read more: Agentic BI and decision intelligenceLink to this question
What if our data is not ready?
Then we fix the foundation first. Dashboards and AI analysts are only as good as the data beneath them, so we start with the sources, quality checks and definitions they need.
Read more: Agentic BI and decision intelligenceLink to this question
Where does our data go?
Where you decide. We deploy models air-gapped, on your premises or in a regional sovereign cloud, so regulated data stays in the country. Data never leaves the enterprise unless you choose a service that allows it.
More questions
- Working with XSISHow we protect your systems, code and data, where data is stored, AI coding tools and the access we need.13 questions
- Software, AI and dataYour data in AI models, explainability and bias, data warehouses, web, mobile and cloud security, and safe migrations.6 questions
- Cyber and quantum securityQuantum-safe encryption, AI agent identity, zero trust, software bills of materials, OT monitoring and security certification.21 questions
- Integrations and industriesERP access, payment files, PCI DSS scope, card and patient data, consent, webhooks and the rules of each industry.24 questions
- Cost and pricingWhat drives the cost of a project or a team, and how we estimate.29 questions
- TimelinesHow long work takes to start and to deliver, and what changes it.10 questions
- Ownership and contractsWho owns the code, the data and the results, and how contracts work.22 questions
- Teams and staffingWho works on your project, how they are chosen and how teams change.30 questions
- Process and communicationHow work is planned, reported and accepted.121 questions
- TechnologyThe platforms, standards and tools we work with.144 questions
- Support and operationsWhat happens after go-live: support, monitoring and change.29 questions
- About XSISWho we are, where we are and how to reach us.6 questions
Start with a conversation, not a contract.
Tell us what you need to build, connect or secure. An architect goes through it with you, then recommends where to start.
What happens next
Agreeing a time
Our team emails you to agree a time for the session.
Pre-consulting session
A free 30-minute online pre-consulting session: we go through your goals, systems and constraints.
Readiness review
In a free 48-hour readiness review, a Principal Architect checks your project against the 6-point Definition of Ready and recommends the track that fits.
Choosing the track
Scope-ready projects receive a binding proposal within 3–5 business days. Concept-stage projects start in the Blueprint Studio. A live system that is failing, undocumented or needs integration starts with a diagnostic of 1–2 weeks. The Blueprint Studio and the diagnostic each have a fixed fee, quoted in the proposal.