Licensed to be used in conjunction with basebox, only.
// security
Cloud
Applies to
Product: Cloud · Audience: Security / Compliance reviewer
Production service with isolated customer environments, operated by basebox. Platform and language model run on servers of the hardware partner FAST LTA in the data center of noris network AG in Munich-East; both are sub-processors (Data processing & sub-processors). No customer-owned physical server is involved. Cloud accounts created before November 2026 run at Hetzner in Nuremberg with AI models from Google Vertex in Frankfurt until the move (Transition phase). This page is the security view of what Deployment models and Customer environment describe technically.
Your organization receives its own basebox organization at <your-organization>.basebox.ai with its own Keycloak realm, its own users, apps, knowledge bases, settings and its own audit log. The chat history is stored by each user's browser. basebox operates the platform, service models and language model on this server. You administer the application and remain the controller under data protection law; basebox processes as a processor on the basis of a data processing agreement (basebox.ai/en/contract). Chats and documents do not leave the Cloud environment in normal operation; you control the deliberate exceptions – web search, connectors, mail and the optional app with an external model.
Security properties
| Property | Cloud | Details |
|---|---|---|
| Infrastructure | Servers from FAST LTA, operated by basebox, in the data center of noris network AG, Munich-East; customer environments run on shared servers | Infrastructure |
| Tenant separation | Own virtual Kubernetes environment and own user management (Keycloak realm) per organization, own subdomain (= the API's X-Realm), own limits |
Isolation |
| Operation | By basebox – platform, updates, service models, inference, backups, monitoring | Administrative access |
| Application administration | By you – users, roles, models, apps, connectors, policies, audit | Customer environment |
| Inference | On the Cloud's servers, shared by customers; a model just for your organization on request. Providers of additional compute only if they are on your list of sub-processors. Accounts from before November 2026: Google Vertex, Frankfurt, until the move | Model providers |
| Encryption | HTTPS for users and API, TLS for connections into your network; at rest encrypted disks (details on request); encrypted backups being set up | Encryption |
| Backup | By basebox: daily, retained for 7 days; 30 days and an encrypted copy in a second data center in Germany being set up | Backup |
| Outbound connections | Only web search (when enabled), app with an external model (when set up), connectors to your systems, mail; connectors are limited to their target hosts at the MCP gateway | Network connectivity |
| Inbound connections | HTTPS 443 from users and API clients; sign-in via your realm or SSO | Network connectivity |
| Data protection role | Customer controller, basebox processor with DPA | GDPR |
What you control
Everything in the administration – and with it all decisions that determine your users' privacy: whether and how conversation content is recorded in the audit log, for how long, whether web search is available and for whom, which connectors reach which systems, whether tools may write, which models users can choose, who is an administrator. The defaults are restrictive (Policies).
What basebox controls
Data center, Kubernetes, storage, the platform's network, versions and update timing, the list of provided models and connector services, the Keycloak configuration (LDAP federation and SSO brokering are set up by basebox at your request). basebox does not manage your users, apps or data and does not see your users' connector credentials.
What leaves the environment
In normal operation nothing – the AI model also runs on the Cloud's servers. Four deliberate exceptions, all controlled by you:
- Web search – the query goes to Staan.ai in the EU, without user identity and user IP; off by default, enabled per app, consent before the first search. Web search
- Connectors – requests to your own systems with the credentials of the respective person. Connectors
- Mail – invitations and notifications to your mail server.
- App with an external model (optional) – none by default; your administrator sets it up and releases it only for selected groups. Requests go to Google Vertex in the EU, on request to OpenAI. Google does not train on the inputs and logs them for abuse detection for no longer than 30 days; as US companies, Google and OpenAI are subject to the US CLOUD Act. Model providers
Complete, with diagram: Data flows.
Open points basebox answers for you
Some details depend on the specific environment or are fixed contractually; ask for them during contract negotiation:
- Certifications and physical access controls of the Noris data center
- Fixed egress addresses for firewall rules on your side
- Details of restore tests, emergency management and disk encryption; basebox does not commit to fixed recovery times (Backup)
- Availability of a private connection (VPN) and of IP allowlisting for inbound user access
Contact: datenschutz@basebox.ai.
Next step: Server