Does Guidely Policy Search train AI models on customer policy documents or employee queries?

No. Guidely operates under contractual Zero Data Retention (ZDR) agreements with all AI inference providers. Neither customer policy documents nor employee questions are ever retained by model providers or used to train foundation models.

How does Guidely prevent unauthorized employees from discovering executive or country-restricted policies?

Guidely enforces pre-search policy folder boundaries (folder_groups) inside the database before any search or AI synthesis takes place. Documents outside an employee’s assigned folders are completely invisible to the search engine, eliminating cross-role inference leaks.

Can organizations configure custom role permissions for different teams or contractors?

Yes. Guidely combines pre-search folder access boundaries with 15 granular functional capabilities—including a Citation-Only Employee mode that displays verified policy passages and visual highlights while disabling AI synthesis.

Security, Privacy & Access Governance

Guidely Policy Search Trust Center

Defensible Semantic Policy Search Platform

Guidely Policy Search is engineered for Chief Information Security Officers, Data Protection Officers, and Enterprise Architects who require strict pre-search access boundaries, contractual Zero Data Retention, and sovereign UK/EU cloud residency before connecting internal policies to AI.

Access Control

Pre-Search Folder Boundaries

Unpermitted folders are excluded inside the database before any search or AI synthesis runs.

Role Security

15 Granular Capabilities

Extensible role permissions to fit every workforce permutation—including Citation-Only mode.

AI Privacy

Zero Data Retention (ZDR)

Zero model training on your policies or employee questions, backed by contractual ZDR commitments.

Sovereign Cloud

UK & EU Data Residency

Dedicated regional hosting in London (UK) and Belgium (EU) with CMEK/BYOK.

Zero Cross-Role Information Leakage

Why Pre-Search Folder Boundaries Matter More Than Post-Search Filtering

Many generic enterprise AI tools index every company document into a single shared pool, run an AI search across everything, and try to hide restricted links right before showing the answer. That approach risks leaking sensitive policy existence or figures inside the AI summary. Guidely enforces access boundaries before search begins.

Conventional Enterprise AI Tools (Post-Search Filtering Risk)

Employee asks: “What is our M&A retention bonus schedule?”
AI searches a single global pool containing both standard HR policies and restricted Executive Board folders.
The language model reads the restricted Executive Board document while formulating its answer, then strips the document link at the end.

Security Failure: Confidential figures or policy existence can leak into the generated prose or influence the tone of the response even when the file attachment is hidden.

Guidely Pre-Search Folder Isolation (`folder_groups`)

Employee authenticates via Single Sign-On (Okta, Microsoft Entra ID, Google Workspace); Guidely resolves their verified role and `folder_groups`.
Database query scopes strictly to permitted folders (e.g., `uk-all-staff`) before any meaning-based or exact-term lookup executes.
Unpermitted folders (`exec-board-remuneration`, `de-works-council`) are mathematically unreachable by both the search engine and the synthesis step.

Security Guarantee: If a policy resides outside the user’s permitted folders, Guidely cannot read, cite, infer, or confirm its existence—triggering a clean Safe Refusal instead.

Extensible Role-Based Security

Tailor Every Permutation of Folder Scope and Functional Capability

Every regulated enterprise structures permissions differently. Whether you need union-regulated workers on a strict Citation-Only view, regional contractors restricted to country-specific safety manuals, or external auditors granted read-only ledger inspection, Guidely lets you combine folder boundaries with 15 granular capabilities.

EXTENSIBLE ROLE-BASED SECURITY • EVERY PERMUTATION SUPPORTED

Tailor Policy Visibility & Platform Capabilities to Any Organisational Structure

Replace blunt “Admin vs. User” settings. Combine Pre-Search Policy Folder Boundaries with 15 Granular Capabilities to match any combination of region, seniority, department, or Works Council mandate.

Active Permutation: 2 Folders × 5 Capabilities

Select a Role Template or Click Any Toggle Below to Build a Custom Permutation:

1. Pre-Search Policy Folder Boundaries

Enforced Before Search

Unchecked folders are excluded at the database layer before search runs—making them mathematically invisible to this role.

2. Extensible Feature & Governance Permissions (15 Capabilities)

Standard UK Employee

Search & Consumption

Policy Authoring & Terminology

Governance, Escalations & Audit

Security & Directory Administration

Resulting User Experience for This Permission Permutation:

Searches All-Staff and UK policies in any of 53 languages. Sees clear summaries alongside highlighted PDF clauses. Executive Severance and German Works Council folders are completely invisible prior to search.

Syncs with Entra ID, Okta & Workday

Complete 15-Capability Permission Matrix

All 15 capabilities can be toggled independently on any custom role or mapped directly to your Identity Provider (SAML 2.0 / OIDC) group claims.

15 Independent Capabilities × Unlimited Folder Groups

Guidely Policy Search 15 granular role capabilities across Citation-Only Employee, Standard Employee, Policy Owner, and External Auditor templates
Capability Key	Category	Operational Purpose	Citation-Only	Standard Staff	Policy Owner	Auditor
search_policies	Search & Verification	Execute policy questions within assigned policy folder boundaries.	Allowed	Allowed	Allowed	Allowed
view_citations	Search & Verification	Inspect exact clause citations, section numbers, and highlighted source paragraphs.	Allowed	Allowed	Allowed	Allowed
view_full_document	Search & Verification	Scroll and read the complete authoritative policy document in the right-hand verification pane.	Configurable	Allowed	Allowed	Allowed
view_ai_synthesis	Search & Verification	Receive plain-language AI summaries above the verbatim citations (disable for Citation-Only mode).	Disabled	Allowed	Allowed	Allowed
translate_cross_lingual	Search & Verification	Ask questions in 53 supported languages with translated summary + native-language source proof.	Configurable	Allowed	Allowed	Allowed
submit_feedback	Employee Actions	Flag unclear clauses or submit helpfulness ratings on policy answers.	Allowed	Allowed	Allowed	Read-only
escalate_to_human	Employee Actions	Route complex exceptions or Safe Refusals to HR, Legal, or Procurement queues with full context.	Allowed	Allowed	Allowed	Disabled
upload_draft_policies	Policy Lifecycle	Upload new or revised PDF, DOCX, HTML, or Markdown policy drafts into staging folders.	Disabled	Disabled	Allowed	Disabled
publish_authoritative_version	Policy Lifecycle	Approve, cryptographically fingerprint (SHA-256), and activate a policy version for live search.	Disabled	Disabled	Allowed	Disabled
manage_folder_groups	Policy Lifecycle	Create policy folder groups (e.g., UK HR, Global InfoSec, Executive Board) and assign document scope.	Disabled	Disabled	Allowed	Disabled
manage_org_dictionary	Policy Lifecycle	Define company-specific acronyms, project code names, and approved terminology mappings.	Disabled	Disabled	Allowed	Disabled
view_confusion_analytics	Governance & Audit	View aggregated Confusion Heatmaps, policy gap reports, and Safe Refusal trends.	Disabled	Disabled	Allowed	Allowed
inspect_audit_ledger	Governance & Audit	Inspect the append-only SHA-256 hash-chained decision ledger and policy version snapshots.	Disabled	Disabled	Scoped	Allowed
export_compliance_packs	Governance & Audit	Export signed CSV/JSON audit logs and point-in-time policy proof bundles for external regulators.	Disabled	Disabled	Disabled	Allowed
manage_roles_and_sso	Security Administration	Configure SAML 2.0 / OIDC group claims, custom role permutations, and API key rotation.	Disabled	Disabled	Disabled	Admin Only

Data Sovereignty & Cryptographic Controls

Your Policies Stay in Your Jurisdiction, Under Your Keys

Guidely is built for regulated financial, healthcare, public-sector, and critical-infrastructure organizations that cannot permit policy documents or employee questions to leave UK or EU boundaries or train third-party AI models.

Contractual Zero Data Retention (ZDR)

All language-model processing executes over enterprise endpoints governed by strict Zero Data Retention agreements. Inference payloads are processed exclusively in volatile memory and immediately discarded—never logged by model vendors and never used for foundation model training.

Zero foundation model training on customer data
No human review of prompts by AI sub-processors

UK & EU Sovereign Cloud Pinning

Choose your dedicated data residency region at tenant provisioning. Document storage, search indices, SHA-256 audit ledgers, and regional AI inference remain strictly pinned to your chosen jurisdiction.

UK Sovereign: London
EU Sovereign: Belgium

TLS 1.3, AES-256 & CMEK / BYOK

All traffic in transit is protected via TLS 1.3 with Perfect Forward Secrecy. Data at rest is encrypted with AES-256-GCM. Enterprise Defensibility customers can supply Customer-Managed Encryption Keys (CMEK / BYOK) via Google Cloud KMS or AWS KMS for instant cryptographic revocation.

Per-tenant database isolation & encrypted backups
Customer-controlled key rotation & instant kill-switch

Standards & Regulatory Alignment

Security & Compliance Readiness Matrix

How Guidely Policy Search maps to information security, compliance management, data protection, and artificial intelligence governance frameworks.

Guidely Policy Search Security and Regulatory Alignment Matrix
Framework / Standard	Focus Area	Guidely Architectural Control
ISO/IEC 27001:2022 & SOC 2 Type II	Information Security & Access Control	SAML 2.0 / OIDC SSO, pre-search `folder_groups` isolation, 15 granular role capabilities, AES-256 at rest, TLS 1.3 in transit, and immutable administrative audit trails.
ISO 37301:2021	Compliance Management Systems	Demonstrable policy communication across 53 languages, point-in-time policy version attribution, and Confusion Heatmaps for continuous policy improvement.
UK GDPR, EU GDPR & UK Data (Use & Access) Act	Data Protection & Residency	Regional pinning in London (UK) or Belgium (EU), contractual Zero Data Retention (ZDR), automated PII redaction in analytics, and configurable retention windows.
EU AI Act (Transparency & Oversight)	Explainable AI & Human-in-the-Loop	Mandatory dual-pane verbatim source highlighting, deterministic Safe Refusal Gate when evidence is absent, Citation-Only mode option, and one-click escalation to human policy owners.
SEC Rule 17a-4 / FINRA 4511 / FCA SYSC	Tamper-Evident Books & Records	Append-only SHA-256 cryptographic hash-chained decision ledger with optional 7-year Write-Once-Read-Many (WORM) archival export.

Security & InfoSec Due Diligence

Frequently Asked Security Questions

Does Guidely Policy Search train AI models on our policy documents or employee questions?+

No. Guidely operates under strict contractual Zero Data Retention (ZDR) agreements with all AI inference providers. Neither your uploaded policy documents nor employee questions are ever retained by model providers or used to train or fine-tune foundation models.

How does Guidely prevent an employee from discovering policies restricted to executives or another country?+

Guidely enforces pre-search policy folder boundaries (`folder_groups`) at the database layer before any search or AI synthesis runs. Documents outside the employee’s permitted folders are never retrieved into memory, making cross-role inference leaks impossible.

Can our Legal or Works Council team disable AI summaries and show only exact policy clauses?+

Yes. Administrators can disable the `view_ai_synthesis` capability for any role or user group, activating Citation-Only Mode. Employees in Citation-Only Mode still benefit from meaning-based search across 53 languages, but receive only verbatim policy passages and highlighted source clauses in the document viewer.

How do we request your Security Architecture Whitepaper and Data Processing Addendum (DPA)?+

You can request the complete CISO Security Pack—including our Security & Zero-Retention Whitepaper, Sub-processor List, Penetration Test Executive Summary, and UK/EU Data Processing Addendum—by booking an Executive Security Briefing below.

CISO Due Diligence Package

Need Our Security Whitepaper, DPA, or Custom Role Review?

Walk through your Identity Provider group structure, regional data residency requirements, and audit retention policies with our security architects—or start a sandboxed 14-day trial today.

View Promotional Pricing