Skip to content
Copyright © 2022-2026 basebox GmbH, all rights reserved.
Licensed to be used in conjunction with basebox, only.

// security

Data flows

Applies to

Product: Demo · Cloud · Server · Audience: Security / Compliance reviewer

Which data flows where: user ↔ basebox, basebox ↔ inference, basebox ↔ service models, basebox ↔ connectors and web search, basebox ↔ identity provider and mail. Per deployment model, where these paths lie differs – not which ones exist. The technical component map is under basebox components.

The principle

Users and API clients talk exclusively to the basebox platform (frontend, AISRV, identity provider) over HTTPS. Everything else – inference, service models, connectors, search providers – is reached only by AISRV. A user never has a direct connection to a model or a target system. In Cloud and Server, in normal operation every path stays inside the environment; only the three explicitly controlled exceptions – web search, connectors and mail – leave it. Only in the Demo does a fourth, permanent path come on top: every model request goes to Google Vertex AI.

flowchart LR
  U["User / API client"] -->|HTTPS| P["basebox platform<br/>frontend · AISRV · Keycloak · storesrv"]
  P -->|OpenAI-compatible API<br/>+ API key| I["Inference"]
  P -->|RAG API| S["Service models<br/>ragsrv · ragsrv-support"]
  P -->|POST /mcp| C["MCP connectors"]
  C -->|allowed hosts only| T["Customer target systems<br/>wiki · tickets · IMAP"]
  C -->|provider hosts only| W["Search provider<br/>Staan (default)"]
  P -->|"LDAP(S) / OIDC"| ID["Customer directory / SSO"]
  P -->|STARTTLS/TLS| M["Customer mail server"]
  style P fill:#f4f2ee,stroke:#524e47,color:#1d1e1c
  style S fill:#dcefe2,stroke:#3a7a49,color:#1d1e1c
  style I fill:#dbeafe,stroke:#1e40af,color:#1d1e1c
  style W fill:#fbf0db,stroke:#b9770a,color:#1d1e1c

The paths in detail

Path What flows Protection Leaves the environment?
Browser / API client → platform Sign-in, prompts, uploads, answers (streaming), administration HTTPS via ingress; OIDC tokens; API key with X-Realm No – that is the environment
AISRV → inference Prompt including system prompt, history, retrieved context, document contents; back the answer API key from secret; TLS when the path crosses hosts or zones Cloud and Server: no – inference runs inside the same data processing boundary. Demo: yes – to Google Vertex AI
AISRV → ragsrv → ragsrv-support Uploaded files for extraction, OCR, embedding; audio for transcription; queries to the knowledge base Internal API keys; shared temp volume No
AISRV → MCP connector → target system Tool call with the user's credentials; back the target system's result User's Authorization passed through; egress allowlist at the gateway; write tools off by default Yes, to your own systems – when you enable the connector
AISRV → web search connector → search provider The text of the query – without user identity and user IP; back results as plain text Exactly one provider per connector; egress allowlist; off by default; consent per user Yes, to the search provider – when enabled
Keycloak → LDAP / OIDC provider User attributes, groups, sign-in confirmation LDAPS (636) or OIDC over HTTPS To your directory – inside your organization
AISRV → SMTP Invitations, notifications (recipient address, link) STARTTLS/TLS, authentication To your mail server
Platform → databases All state Internal cluster traffic; credentials from secrets No

What never flows: telemetry to basebox (disabled on Server), training data (basebox does not train on your content), conversation content in logs (only at trace level, off by default – Audit & logging).

Per deployment model

basebox Cloud. Platform, service models and language model run on the same basebox server in the Noris data center in Munich, inside your isolated environment. The AISRV → inference path also stays on this server. The paths to your systems – connectors, mail, directory – come from the Cloud into your network; you allow them per integration at your firewall. The web search path goes from the Cloud to the provider. Details: Infrastructure · Network connectivity.

basebox Server. All paths sit in the customer network – even when the server is hosted at basebox, because it is dedicated. If inference sits on a separate GPU host, prompts, context and document contents travel between application and inference server; both belong in the same approved data processing boundary and the path is TLS-protected (Inference architecture). Outbound paths are set by your firewall; air-gapped, web search and online downloads are unavailable (Air-gapped environments).

Demo. A separate setup: platform at Hetzner, language model Claude via Google Vertex AI. Here the AISRV → inference path leaves the environment and goes to Google. Real data does not belong in the Demo (Demo).

What a prompt contains

For assessing the AISRV → inference path it matters what arrives there: the organization's system prompt, the user's personal personalization, the conversation history so far, the current input, for knowledge bases and documents the retrieved text passages, for connectors the tool results (that is, content from your target systems or web hits). Everything a user sees or uploads in the chat can reach the model – and thus the inference hardware.

For the review

  • Exactly one firewall rule per path; nothing opened wholesale (Networking for Server).
  • Document web search and connectors as separate decisions – each with provider/target system, user group, usage rule.
  • Web search and connectors for internal data not in the same app (Introduction to web search security).
  • Where inference runs is part of the data processing boundary – on a separate host, include it in the documentation.

Next step: Storage