Security
Know what an AI system can access, do and change.
Every implementation needs rules for data, permissions, approvals and operational responsibility. We define these with the client before a solution goes live. The controls depend on the process, its risks and the connected services.
- AccessWhat the system can access
- PermissionsWhat it may do
- ApprovalWhere a person decides
- RecordWhat gets logged
- OperationsWho owns the solution
On this page
Access
Access limited to the work required
Role-based access
Define permissions by function and responsibility, not informal arrangements between individuals.
Least privilege
Grant only the access needed for a task.
Service identities
Where supported, automation uses dedicated identities rather than an employee’s personal account.
Credential management
Store secrets securely, not in application code.
Access lifecycle
Agree how permissions are issued, reviewed and removed.
A person decides
Human approval where it matters
We distinguish between reading information, preparing a recommendation, taking an approved action and completing a step that requires a person’s decision.
- Level 1Reading information
- Level 2Preparing a recommendation
- Level 3Taking an approved action
- Level 4A step that requires a person’s decision
reading datasystem worka person decides
May require additional controls
- financial impact
- sensitive information
- external communication
- uncertain results
Records
A record of important actions
We agree what should be logged, who may review the logs and how long records are retained. Relevant records may include the input, action, outcome, approval, error and software version, subject to data protection and technical constraints.
- input
- action
- outcome
- approval
- error
- software version
Support and handover
Support and handover are part of the design
Contracts define support scope, software and data rights, and exit arrangements.
Before launch, we agree
- who monitors the solution,
- how issues are escalated,
- what recovery procedures exist,
- what documentation the client receives.
Data
Where your data is processed depends on the services used
We document relevant hosting, storage, model services, processors and international data transfers for the proposed solution. A custom application running on your own infrastructure does not necessarily mean every connected AI service processes data there.
Typical environment
Microsoft 365 and existing business applications.Possible model providers
Microsoft, Anthropic and OpenAI, selected according to use case and contractual requirements.Deployment options
Subject to technical feasibility and the specific service, components may run in the client’s environment, private cloud or a managed service.Regulation
EU AI Act: assess the actual use case
Legal requirements depend on what the AI system does, who provides or deploys it and whether it falls into a regulated category. We support the technical and organizational assessment; legal classification and compliance obligations must be confirmed for the specific use case.
- 2 February 2025Selected initial provisions, including prohibited practices, became applicable.
- 2 August 2025Governance and general-purpose AI model obligations began to apply.
- 2 August 2026Most remaining provisions, including relevant transparency requirements, became applicable.
- 2 December 2027High-risk AI systems under Annex III are scheduled to become subject to the respective rules.
- 2 August 2028Relevant high-risk AI in regulated products under Annex I is scheduled to become subject to the respective rules.
EU timeline summary, checked 15 October 2026. Source: European Commission — AI Act. Information only; not legal advice.
Status
Partnerships and certification
Security or incident inquiry
Email milo@enterai.cz. Client-specific incident contacts, support windows and escalation arrangements are defined in the relevant agreement.
- Microsoft Solutions Partner.
- TD SYNNEX Destination AI.
- Partner programme approved by TD SYNNEX.
- GDPR.
- We explain our website’s data processing in the Privacy Policy. Actual project compliance depends on the agreed solution and contractual arrangements.
- ISO 27001.
- ENTER does not currently claim to hold an issued ISO 27001 certificate.
Discuss security requirements
Tell us about the process and the systems involved. In a 30-minute call, we will discuss the access, approvals and data processing it would require.