Skip to content
Copyright © 2022-2026 basebox GmbH, all rights reserved.
Licensed to be used in conjunction with basebox, only.

// security

Safety Notice

  • Version: 1.0
  • As of: October 2025

1. Purpose

This document informs operators and administrators about safe use, operation and limits of the basebox AI Management System.

It supplements the technical documentation and the compliance package under the EU AI Act (Regulation (EU) 2024/1689).

2. General safety notes

  • The system may only be operated in secured, customer-owned networks. External ports and API endpoints must be protected by firewall rules.
  • Operation takes place entirely on the customer's dedicated server (basebox Server). Cloud components or remote access are permitted only with the customer's express consent and on the customer's own responsibility.
  • VPN/PAM maintenance access may be enabled exclusively for support purposes and must be disabled afterwards.

3. User and access management

  • Every user requires an individual account (OIDC/Keycloak).
  • Administrators are obliged to use strong passwords or two-factor authentication.
  • API keys may be issued only to authorised systems or persons.
  • After an employee leaves, accounts must be deactivated or deleted without delay.

4. Data processing and data protection

  • All data, embeddings and knowledge sources remain local.
  • No telemetry or data transfer to basebox or third parties takes place (air-gapped operation).
  • Operators must ensure that no sensitive or personal data is entered unencrypted into prompts or knowledge sources.
  • Users can delete locally stored content via the user interface or CLI.
  • TLS protects data transfer; stored data (at rest) is currently unencrypted.

5. Operation of the AI models

  • Shipped models (e.g. Llama 3.3 70B, quantised variants) are provided unchanged.
  • Administrators decide which models are installed and activated.
  • Responsibility for purpose, content and use lies entirely with the customer.
  • Models must not be used for prohibited practices under Article 5 EU AI Act (e.g. social scoring, manipulation, real-time biometric surveillance).

6. Logging and monitoring

  • The system logs technical events locally.
  • Only administrators with server shell access can view logs.
  • Prompt content is stored exclusively when trace level is enabled.
  • Operators are obliged to review and delete log data regularly in accordance with internal policies.

7. Updates and maintenance

  • Security and feature updates are announced by e-mail and release notes.
  • Backups should be created before installing new versions.
  • Container or package integrity checks (signatures) are in preparation.
  • No automatic updates: installation is the customer's responsibility.

8. Error reports and incidents

  • Security or functional problems must be reported via the integrated support ticket function.
  • Critical events (e.g. unauthorised access, data leak, faulty model response with risk character) must be reported to basebox without delay:

datenschutz@basebox.ai

  • Operators should define internal processes for incident handling and escalation.

9. Restrictions and known limits

  • No internal moderation or manual approval of AI outputs.
  • No encryption of stored data (at rest).
  • No automatic audit export.
  • Model results are statistical probabilities and not guaranteed correct facts.
  • basebox is not liable for content, decisions or consequences arising from the use of the models.

10. Responsible body

basebox GmbH Bahnhofplatz 3 86919 Utting am Ammersee Germany

E-mail: datenschutz@basebox.ai

11. Versioning

This document is reviewed with every product version and updated in the event of technical or regulatory changes.

===========================================================

End of SAFETY NOTICE

===========================================================