The security model we are building RiOS on.
RiOS is in development. This page sets out the security and privacy model we are building the platform to, alongside how the Revenue Audit already handles your data today. We would rather show the model early than overstate what is live.
How data is designed to move through RiOS.
A simple map of the intended flow, from the systems you already use to the numbers on your dashboard. This is the target architecture for the platform, currently in build.
- 01Your existing systems
Everything starts in the systems you already run: your CRM, ERP, finance and marketing tools. RiOS asks for read access only, and you decide which systems it may see.
- 02RiOS reading layer
The reading layer pulls data out of those systems and never writes back on its own; automations only run after you approve them. Your tools stay the source of truth.
- 03Tokenisation layer
Before anything reaches an AI model, a processing step strips names, email addresses and other identifying data and replaces them with tokens. The design rule has no exceptions: every AI model only ever sees tokens, never your customers' real data, wherever in the world that model runs.
- 04AI engine
The AI engine is built inside two hard rules. Row-level security in the database decides what each user may see, and fail-closed publication means a finding that doesn't clear the confidence bar is never shown.
- 05Leak detection & scoring
Findings from every system are combined into one agreed set of numbers: what leaks, what it costs in euros and how sure we are. No two dashboards that disagree.
- 06Dashboard & recommendations
Only checked results land on the dashboard: the leak, the euro amount and the suggested fix. That is what your team acts on, with the trail back to the source data.
The platform is built so a processing step removes personal and identifying data before anything reaches an AI model. Every model then only ever sees tokens, never your customers' real data. Where that model runs changes nothing: inside the EU or outside it, it gets the same tokens. Privacy isn't a checkbox here, it's the default we build to.
The rules the platform is built to.
The rule lives in the database itself, not just the app. A broken or misconfigured frontend can't get around it.
If the AI isn't sure enough about a finding, it doesn't publish it. Nothing reaches a dashboard unless it clears a confidence bar.
Staff access is tied to your verified company domain (checked by DNS), not to hand-managed permission lists.
The platform is being built on EU-hosted infrastructure, and we will name every subprocessor before you onboard. Anything sent to an AI model is tokenised first.
A DPA (verwerkersovereenkomst) is part of onboarding: nothing gets connected before it is signed.
The Revenue Audit itself needs no system access: your answers and our notes are the only data involved, and they are never shared or resold.
What RiOS reads, and what it never touches.
Read access to business data, nothing more. This is the exact split.
- Deals, pipelines and account activity from your CRM
- Invoices and payment status from billing and finance
- Campaign spend and results from your ad platforms
- Support tickets and response times
- Send personal data to AI models: it is tokenised first
- Write or change anything without your approval
- Reach systems you haven't connected
- Sell your data, or share it for marketing
The questions procurement and legal actually ask.
Only your answers to the audit questions and our own notes. Nothing gets connected to your systems for the audit; there is no integration, no data export, no access to grant.
Within the EU. That is a design requirement for the platform, not an afterthought: we choose EU-hosted infrastructure and will name every subprocessor in the DPA before you onboard. Anything that goes to an AI model is tokenised first.
Yes: signing a DPA (verwerkersovereenkomst) is part of onboarding, before anything is connected. Ask us and we'll walk your legal team through the data flows ahead of that.
The platform is built on two rules: access tied to your verified company domain (checked by DNS), and row-level security in the database deciding what each user may see. No hand-managed permission lists to drift out of date.
Tokens, not people. The pipeline is designed so personal and identifying data is removed before anything reaches an AI model. That holds for every model we use, not only the ones outside the EU: all of them see anonymised tokens and nothing else.
Your own systems were always the source of truth, so nothing needs to be migrated back. The data RiOS holds is deleted; we keep nothing longer than necessary, in line with our privacy policy.
The RiOS Audit follows proven business-analysis methods, including MECE issue trees, the Pyramid Principle and Three Horizons planning, used the same way across all five blocks.
Ask us anything about the data flows, the DPA, or the architecture. You'll talk directly to the person building it.
From the blog
What AI actually changes in a company, several times a week.
- AI Reality CheckAI Reality Check #04: Wat gebeurde er deze week in AI?De EU opent haar eerste AI Act-onderzoek naar OpenAI en Anthropic, India meldt agents die bij bedrijven binnenkwamen via sleutels die openlagen, een vloot testagents van Tencent probeerde ruim 2.600 keer data van Alibaba's kaartendienst te halen en Google verdubbelt eind november de prijs van zijn nieuwe agentmodel. Wat die week betekent voor jouw bedrijf.
- AI in BusinessAI in Business #04: Waar een installatiebedrijf geld laat liggenIn de bouw lekt het tussen de bouwplaats en de administratie. Meerwerk dat mondeling is afgesproken, regiewerk zonder werkbon en materiaal dat aan geen project hangt. De volledige rekensom voor een installatiebedrijf met 40 medewerkers.
- AI ExplainedAI Explained #03: Waarom een AI-agent nooit jouw inlog krijgtEen agent doet wat hij kan, niet wat je bedoelt. Minimale rechten is het begrip dat bepaalt wat hij kan. Wat het is, waarom het bij een agent zwaarder weegt dan bij een medewerker, wat er misgaat met jouw inlog en hoe je het vandaag regelt.