The user's permissions
A workflow acts on behalf of a person and inherits their permissions. A document that person cannot open will not appear in an answer either.
Security, data and EU hosting
About this source
Gen8
Source: Security, data and EU hosting
Managed AI service for SMEs. We set up, connect and manage; you stay in control.
© 2026 Gen8 VOF · Dutch Chamber of Commerce 92978789 · Delft
Security and data
Permissions remain decisive, even when a workflow does the work
A workflow sees only what the person it acts for may see. Processing takes place in the EU, every step is logged, and a person decides where consequences are significant.
- Processing in the EU
- Human approval
- A log of every step
Security in AI workflows is not a layer you add afterwards. It is built into what they may see, what they may do themselves and whether you can reconstruct what happened afterwards.
We answer those three questions for each process, together with your administrator, before anything goes into production.
Retrieve within permissions
The workflow retrieves only what it needs for this task, through the integration and with the user's permissions.
Process in the EU
Processing takes place on EU infrastructure. We record the suppliers involved for each workflow.
Propose, not execute
The result is a draft, task or proposed change with a visible difference and source reference.
Record
Proposal, approval and execution are logged so it is clear afterwards who decided what.
↻ every step is logged
| Level | What the workflow does | Where people are involved | When we choose this |
|---|---|---|---|
| Read only | Retrieves, summarises, flags | Reads the result | Reporting, knowledge questions, monitoring |
| Human approval | Makes a proposal with a visible change | Approves, edits or rejects | Email, CRM changes, documents, anything with consequences |
| Automatic with logging | Executes and records | Checks afterwards through the log | Small, reversible actions within one system |
Your systems stay yours
Integrations run on your accounts and permissions. We request no access broader than the process we are building for.
Resources and access agreed upfront
Before anything goes into production, ownership of workflows, knowledge sources and integrations is recorded in writing.
A workable exit
Stopping means access is revoked and you keep what belongs to you: your data, documents and process description.
Management is explicit
If a system or integration changes, someone must update the workflow. We agree who does that and how quickly instead of assuming it.
Is our data used to train models?
We build workflows on supplier models and do not use customer data to train models. We record the supplier used for each workflow and its terms for each engagement.
Can a colleague use a workflow to access documents they are not allowed to see?
No, that is the starting point: the workflow inherits the permissions of the user it acts for. If source-system permissions are too broad, a workflow does not fix that; we report the finding.
What is in the log?
Sources consulted, proposal made, who approved or rejected it and what was written afterwards, with timestamps.
Where does processing take place?
On EU infrastructure. We record the components and suppliers involved for each workflow before it enters production.
Do you have a data processing agreement?
It is part of every engagement and we sign it before working with real data. The current version and status of our certifications remain marked above as open items until the documents are final.