Skip to content
Copyright © 2022-2026 basebox GmbH, all rights reserved.
Licensed to be used in conjunction with basebox, only.

// security

Data flows

Applies to

Product: Cloud · Server · Audience: Security / Compliance reviewer

Which data flows where: user ↔ basebox, basebox ↔ inference, basebox ↔ service models, basebox ↔ connectors and web search, basebox ↔ identity provider and mail. Per deployment model, where these paths lie differs – not which ones exist. The technical component map is under basebox components.

The principle

Users and API clients talk exclusively to the basebox platform (frontend, AISRV, identity provider) over HTTPS. Everything else – inference, service models, connectors, search providers – is reached only by AISRV. A user never has a direct connection to a model or a target system. In Cloud and Server, in normal operation every path stays inside the environment; only the explicitly controlled exceptions – web search, connectors, mail and, when set up, the app with an external model – leave it. Only in the Cloud transition phase until November 2026 does a fourth, permanent path come on top: every model request goes to Google Vertex AI in Frankfurt (Transition phase).

flowchart LR
  U["User / API client"] -->|HTTPS| P["basebox platform<br/>frontend · AISRV · Keycloak · storesrv"]
  P -->|OpenAI-compatible API<br/>+ API key| I["Inference"]
  P -->|RAG API| S["Service models<br/>ragsrv · ragsrv-support"]
  P -->|POST /mcp| C["MCP connectors"]
  C -->|allowed hosts only| T["Customer target systems<br/>wiki · tickets · IMAP"]
  C -->|provider hosts only| W["Search provider<br/>Staan.ai (EU)"]
  P -->|"LDAP(S) / OIDC"| ID["Customer directory / SSO"]
  P -->|STARTTLS/TLS| M["Customer mail server"]
  style P fill:#f4f2ee,stroke:#524e47,color:#1d1e1c
  style S fill:#dcefe2,stroke:#3a7a49,color:#1d1e1c
  style I fill:#dbeafe,stroke:#1e40af,color:#1d1e1c
  style W fill:#fbf0db,stroke:#b9770a,color:#1d1e1c

The paths in detail

Path What flows Protection Leaves the environment?
Browser / API client → platform Sign-in, prompts, uploads, answers (streaming), administration HTTPS via ingress; OIDC tokens; API key with X-Realm No – that is the environment
AISRV → inference Prompt including system prompt, history, retrieved context, document contents; back the answer API key from secret; TLS when the path crosses hosts or zones Cloud and Server: no – inference runs inside the same data processing boundary. Cloud in the transition phase: yes – to Google Vertex AI, Frankfurt
AISRV → ragsrv → ragsrv-support Uploaded files for extraction, OCR, embedding; audio for transcription; queries to the knowledge base Internal API keys; shared temp volume No
AISRV → MCP connector → target system Tool call with the user's credentials; back the target system's result User's Authorization passed through; egress allowlist at the gateway; write tools off by default Yes, to your own systems – when you enable the connector
AISRV → web search connector → search provider The text of the query – without user identity and user IP; back results as plain text Exactly one provider per connector; egress allowlist; off by default; consent per user Yes, to the search provider – when enabled
AISRV → external model (app with an external model, optional) As on the path to inference: the app's instruction, history, context, document contents HTTPS; only in the separate app that the administrator releases for selected groups Yes, to Google Vertex in the EU, on request to OpenAI – only if your administrator sets up the app (none by default); on Server only if your firewall allows the connection
Keycloak → LDAP / OIDC provider User attributes, groups, sign-in confirmation LDAPS (636) or OIDC over HTTPS To your directory – inside your organization
AISRV → SMTP Invitations, notifications (recipient address, link) STARTTLS/TLS, authentication To your mail server
Platform → databases All state Internal cluster traffic; credentials from secrets No

What never flows: content as telemetry to basebox (on Server there is no telemetry; in the Cloud basebox records only operational data such as load and error messages), training data (basebox does not train on your content), conversation content in logs (only at trace level, off by default – Audit & logging).

Per deployment model

basebox Cloud. Platform, service models and language model run on the Cloud's servers in the data center of noris network AG in Munich-East, inside your own environment. The AISRV → inference path also stays there. The paths to your systems – connectors, mail, directory – come from the Cloud into your network; you allow them per connection at your firewall. The web search path goes from the Cloud to the provider. Details: Infrastructure · Network connectivity.

basebox Server. All paths sit in the customer network – even when the server is hosted at basebox, because it belongs to exactly one customer. If inference sits on a separate GPU host, prompts, context and document contents travel between application and inference server; both belong in the same approved data processing boundary and the path is TLS-protected (Inference architecture). Outbound paths are set by your firewall; air-gapped, web search and online downloads are unavailable (Air-gapped environments).

basebox Cloud (transition phase until November 2026). Until the move, a shared environment at Hetzner in Nuremberg, logically separated, with AI models from Google Vertex in Frankfurt. Here the AISRV → inference path leaves the environment and goes to Google. Health data and other special categories under Art. 9 GDPR are best processed only after the move (Transition phase).

What a prompt contains

For assessing the AISRV → inference path it matters what arrives there: the organization's system prompt, the user's personal personalization, the conversation history so far, the current input, for knowledge bases and documents the retrieved text passages, for connectors the tool results (that is, content from your target systems or web hits). Everything a user sees or uploads in the chat can reach the model – and thus the inference hardware.

For the review

  • Exactly one firewall rule per path; nothing opened wholesale (Networking for Server).
  • Document web search and connectors as separate decisions – each with provider/target system, user group, usage rule.
  • Web search and connectors for internal data not in the same app (Introduction to web search security).
  • Where inference runs is part of the data processing boundary – on a separate host, include it in the documentation.

Next step: Storage · Data processing & sub-processors