Pathbot Security & Compliance

At indigitall, securing your enterprise AI operations is our top priority. The Pathbot infrastructure is built on a foundation of strict data privacy, robust architectural controls, and multi-layered AI security mechanisms designed to mitigate risks associated with Generative AI.

AI Governance and Security Testing

AI-Specific Penetration Testing: The indigitall AI surface undergoes regular, rigorous penetration testing specifically designed for Generative AI systems. These tests are conducted by independent, third-party security firms to ensure continuous resilience against emerging threats.
Audited Governance: We maintain a formal governance framework for the use of Generative AI. This framework ensures complete control, visibility, and mitigation of ethical, regulatory, and security risks across the platform.

Data Architecture and Context Control

Documented Data Flow: The system follows a secure, predictable path. The channel receives the user message and logs the trace within indigitall. It then retrieves the client's static business context and forwards it to the Large Language Model (LLM). When authorized, the bot can securely invoke the client's backend APIs for read/write operations.
Complete Client Control: You retain full ownership and authority over your data. Clients formally decide exactly which business context, files, and backend integrations are exposed to the Pathbot.
Data Minimization: All conversational flows strictly adhere to personal data minimization principles. We only process the data absolutely necessary to fulfill the user's request, applying this standard across the entire platform.

Technical and Perimeter Protection

End-to-End Encryption: All communications and API calls are encrypted in transit using TLS 1.2+ and TLS 1.3 (HTTPS). Furthermore, all conversational logs and databases utilize AES-256 encryption at rest.
API and Credential Security: Secret integration keys and credentials are hosted exclusively on the server side; they are never exposed to the client side.
Infrastructure Protection: Hosted on Google Cloud Platform (GCP), our infrastructure is shielded by enterprise-grade firewalls and advanced anti-DDoS protection.

Operational Quality and Risk Controls

Hallucination Protection (RAG): To ensure accuracy and reliability, Pathbot utilizes Retrieval-Augmented Generation (RAG). The bot's responses are strictly constrained to the validated knowledge base uploaded by the client, preventing the LLM from fabricating outside information.
Filters and Consumption Limits: We implement automated ingestion monitoring, exclusion rules (such as URL/page blocklists), and strict user-level token and request limits. This prevents platform abuse and protects you from unexpected cost overruns.

Multi-Layered AI Security

To ensure safe interactions, Pathbot enforces a dynamic, multi-tiered security perimeter around the language model:

Behavioral Blocking: Automatic detection and blocking of users exhibiting suspicious or anomalous behavior.
Input Guardrails: We inspect and control what the user asks before the prompt ever reaches the bot. Malicious or inappropriate prompts are blocked from being evaluated by the LLM.
Native LLM Security: Leveraging the built-in alignment and safety filters of the underlying foundational models.
Output Guardrails: Final inspection of the generated response to ensure the bot does not return sensitive, inappropriate, or out-of-scope information to the user.

Guardrail Methodology

Our input and output guardrails combine two distinct methodologies to ensure maximum safety and low latency:

Heuristic Guardrails: These are predefined rules and programmed logic applied directly to the text input/output. Acting as high-speed filters, they detect specific patterns, keywords, or unwanted characteristics in the content instantly, prior to any LLM processing.
LLM-Based Guardrails: For more nuanced moderation, we utilize an LLM specifically instructed to act as a "moderation specialist." Instead of relying on rigid, fixed rules, this secondary LLM evaluates the context and intent of the content based on complex, dynamic safety guidelines.