Architecture & responsibility
How AI works with your systems: limited tools, clear permissions, a privacy gateway and human approvals. An outline for you and your IT team.
Employee
asks a question
Chat interface
ChatGPT · Claude · custom UI
Company MCP
routes to the right domain
Domain MCP
ERP · email · webshop · CRM · documents
Privacy Gateway
Filters · tokenises · audits
Your app
Source of truth
Per call, the gateway controls which fields AI sees and replaces sensitive values with tokens: «Hans Müller, hans@firma.ch» wird zu Customer_8f31. AI never sees the app itself.
In tokenised mode, the model receives, for example, «Kunde_8f31» instead of a name and email address. We define which fields are removed, replaced or deliberately shared for each workflow. Direct mode remains separate and subject to review.
There is no shared AI account with full access. Each request runs on behalf of a specific person, using their roles and permissions. Information Hans cannot access is also unavailable to the AI acting on his behalf.
The AI receives clearly defined functions such as get_order_status(order_ref) or list_open_invoices(customer_ref). It has no unrestricted database access, bulk export capability or open-ended tools.
Issuing a credit note, changing a contract, blocking an account or exporting data requires explicit human confirmation. The AI proposes actions and your team decides.
Agreed tool calls are logged with the user, time, tool, purpose and result. Scope, retention and access are defined for each production setup.
The application and gateway can run on premises or in a Swiss or EU data centre. For an external model, we document the recipient, region, retention, transfer basis and contract. For particularly sensitive areas, we assess locally hosted models.
Each module can be delivered in two operating modes. You decide for each customer and data category what reaches the AI provider, such as Anthropic or OpenAI.
In this mode, agreed personal data is tokenised or redacted before transmission. The AI provider receives placeholders such as «Kunde_8f31» for these fields. Operational data that has been explicitly approved can remain usable. We still review the provider, retention and contract because prompts and other context may contain data.
The same integration without masking: real names, addresses and amounts reach the model. This mode is intended for cases where working with the original data is deliberate. The AI provider’s plan and settings then apply, as explained below.
Retention and training (Anthropic, as of 29 August 2026)
Before production use, we document the applicable data processing agreement, transfer basis and product settings. Anthropic incorporates its DPA into its Commercial Terms; OpenAI publishes a separate DPA: Anthropic DPA · OpenAI DPA. Details about recipients and data transfers are provided in the privacy policy.
The privacy gateway is more than a diagram. An interactive split-screen demo shows, for each tool call, which fields are redacted, tokenised or passed through, with an audit log in real time.