Architecture & security
How it is built
and what it touches
For IT teams and for data protection audits. Everything here is published at aski.dev/en/security and can be verified without us.
AskiEnd to end, live
AskiWithout opening a single inbound port
Many on-premise installations are not published, and they do not need to be. For those cases a private-network node is installed on a machine in the same network where the ERP lives, and the backend goes in through it.
No inbound ports
The node opens the connection outward, the same way a browser does. No public IP, no port forwarding, no publishing the ERP.
Your server untouched
The node sits on any machine in that network. The ERP stays exactly as it is.
Fifteen minutes
One command we send you ready to paste. Then, in the app, you tick a checkbox and enter the ERP's internal address.
- Isolation: each customer joins with their own key, tagged and revocable. The rules only allow backend → your node, and only towards the ERP's ports: two customers' nodes cannot see each other.
- Your credentials stay yours: you enter them in the application, exactly as in a normal connection.
AskiYour ERP does not move
The strongest guarantee is not an access control: it is that there is no copy of your data to protect.
No replica
We do not copy or sync your database. There is no store of ours with your information inside.
No nightly job
No ETL, no scheduled job, no sync window to watch over.
Without you, no data
If you switch off your server, Aski stops answering: the data lives at your place, not ours.
- The one thing we do store: the conversation history — the question and the answer as shown, which may include the figures that were queried — tied to the account of whoever asked, and deletable by them from the app.
AskiQueries by default. Acting, only with your OK
By default, all the system issues against the ERP are queries. Acting is a separate capability: it has to be switched on, exists on Enterprise Plus, on the SAP plans and on the Dedicated plans, and never reaches S/4HANA.
- Querying: Odoo through the standard API (XML-RPC); SAP through OData or the Service Layer.
- Closed catalogue: ten operations on Odoo —two on Business One—, always on a specific record. The model proposes which one; the server decides whether it applies.
- Nothing without your confirmation: you are shown what and on which record. The proposal expires after 15 minutes and every execution is traced.
- Outside that catalogue: it is cut before touching the ERP and the attempt is logged. The only other write is the alert you send to the inbox of your own Odoo.
AskiAski sees what that user sees. No more, no less.
It connects with the credentials of the user you authorise and inherits their permissions. We do not ask for an administrator or for special access.
- You define the scope: give it a user limited to sales and Aski only sees sales.
- No privilege elevation: there is no superuser and no jumping over the rules.
- Your rules still rule: ERP permissions and record rules are respected as they are.
- Cut access whenever you want: disable that key in your own ERP and it is over, instantly.
- Without depending on us: no ticket to open, no reply to wait for.
- Verified: a user without accounting access gets "you do not have access", and is not charged for the query.
AskiThree layers, and the first is the one that counts
No shared repository
We keep no copy of anyone's ERP, so there is no place where two customers' data could cross. Every query runs live against that customer's instance.
Each connection, one owner
Credentials, conversations and messages hang off their owner's identifier, and every query is filtered by the authenticated user. No API route returns a credential in clear text.
The ERP permission rules
Aski never sees more than the connected user sees in their own ERP: if they cannot see costs, margins or another company, neither can Aski.
AskiAll infrastructure, in the United States
| Component | Provider | What it receives |
|---|---|---|
| Backend and database | Railway | Hosts the infrastructure. Does not query the data. |
| Language model | Anthropic — Claude | Question, field names and a bounded extract of rows. |
| Website and web app | Vercel | The interface only. It never receives ERP data. |
| Link to internal ERPs | Tailscale | Only on tunnelled connections: organisation name, machine name and network ranges. It never receives the content of your queries. |
| Email, logs and errors | Resend · Better Stack · Sentry | Platform emails and traces with no message content. |
| Backups | Daily backup | A copy of the database, retained for 30 days. |
There is an international transfer of data to the United States, and it is declared as such. The full list, with what each provider receives and its country, lives in section 4 of aski.dev/en/privacy.
AskiA bounded extract, never your database
To write the answer in your language, the model receives the question, the model and field names, and an extract of the records that query returned.
- It may contain business data: customer names or amounts. We say it before you have to ask.
- Never sent: your full database or your credentials.
- It trains nothing: Anthropic does not train on that content; it retains it for up to 30 days solely for abuse detection.
AskiEncrypted in transit and at rest
- In transit: TLS 1.2 or higher on every leg, app ↔ backend and backend ↔ ERP.
- At rest: the ERP password or API Key is encrypted with AES-256-GCM before being stored.
- Accounts: passwords as bcrypt hashes; sessions with signed tokens.
- Device: encrypted storage with a key from the Android Keystore.
- Operational access to the database is restricted to a minimal number of administrators, and audited.
- SQL injection and model manipulation are detected before reaching the AI, and logged.
- Sensitive fields and restricted models are rejected by list.
What this does not mean: the encryption key lives on our server, because the backend needs to decrypt in order to open the connection. As the operator, technical access exists. We would rather declare it than let you assume otherwise.
AskiIt is really deleted, and we say what is not
Deletion from the app
Immediate and permanent. Requires confirmation and re-authentication. It removes chat history, credentials, learned vocabulary, sessions, tokens and the security log.
What is kept, and why
Billing history, five years under Peruvian tax law, with the email anonymised. And a deleted account may remain in backups for up to 30 days, until they expire.
- Data subject rights: access and deletion from the app itself, history export on request, and contacto@aski.dev as the formal channel with a reply within 7 business days.
AskiWe would rather you hear it from us
No SOC 2, no ISO 27001
We hold neither certification.
The pentest is our own
We ran it and recorded it ourselves; it is not an independent third-party audit.
No regional residency
We do not offer hosting in the EU or in your country: everything is in the United States.
What you can verify: the architecture, the public and versioned policy, the three-page security brief your auditor can file, and your own audit from your side — Aski comes in through the standard API with the user you created, like any other client.
Next step
What do you need to give the green light?
If it is the data processing agreement, send us your template and we return it reviewed. If it is seeing the real behaviour, we connect one customer with a read-only user and you watch it yourself.