Security
you can verify

The full technical detail for your IT department and board — from encryption and access control to the architecture behind every answer Sifta gives.

Cryptographic Vault (AES-256)

Every stored file and every piece of data is encrypted with the AES-256 algorithm, using unique protective keys per record — from KSeF financial keys to third-party integrations.

JWT Lifecycle & Partial Tokens

Passwords and financial-integration credentials are secured with an advanced hashing function (PBKDF2) before they're written to the database. Sessions run on short-lived JWTs, and access to sensitive data requires a second factor (2FA) plus a trusted device.

Contextual DLP Engine

The system scans every text input and every document it reads for passwords, access keys, and card numbers — before any of it reaches the RAG engine.

Automated Anomaly Guard

A specialized AI layer monitors execution flows. The three-tier access model (Employee / Manager / Administrator) is enforced directly in the database, so any attempt to bypass it from the browser is blocked instantly.

Rate Limiting & Brute Force

Suspicious IP addresses and brute-force password attempts are blocked automatically, backed by exponential backoff and request limits on every API endpoint.

Sterile Whistleblowing Route

Every client's data lives in its own, physically isolated directory — no data can leak between customers. On top of that, an anonymous whistleblower channel runs its own data flow, outside the standard audit history.

AI Safety

Our AI runs on a closed architecture, inside our own environment. Whatever you share with it, you never have to worry about that data being used to train language models — the way other companies do.

Other AI Tools

Many popular AI assistants feed the data you enter back into their own training pipeline, to improve their general-purpose models.

Sifta's Closed Environment

Your data stays inside your own isolated environment and is never used to train any language model — for Sifta or anyone else.

The Technical Layer

The infrastructure foundation everything else is built on.

Core Infrastructure

Built on Hono (Node.js) and TypeScript — strict data typing, high stability, and resilience to errors. Powered by Better-SQLite3 in Write-Ahead Logging (WAL) mode for instant reads and writes with no latency.

Multi-Tenant Isolation

Designed strictly around a Shared-Application, Isolated-Data pattern. Every enterprise (Tenant) operates within physically and logically segregated data domains and directory structures.

Intelligence & RAG Layer

A continuous data pipeline that transforms raw uploads into corporate knowledge. Includes a unique 'Knowledge Purgatory' staging phase before AI semantic synthesis and tokenization.

Real-Time WebSocket Protocol

A bidirectional streaming layer built on WebSockets (Node-WS) — real-time streaming of AI responses and instant alerts across the organization.

Definitive Access Model (RBAC)

Sifta operates on a strict three-tier hierarchy: Employee, Manager, and Administrator. Data visibility is enforced mathematically at the database layer. Managers can generate performance summaries exclusively for their direct reports, while AI Agents respect the caller's execution policy boundaries.

Tier 1: Employee

Task Execution, Internal RAG Access

Tier 2: Manager

Team Orchestration, Performance RAG

Tier 3: Admin

System Topography, AI Spending Approvals

Encrypted at Rest, Sterile in Flight

Unlike consumer-grade tools, Sifta treats Knowledge as a liability if exposed. Sifta ensures complete cryptographic segregation. Financial integration tokens (KSeF) and API keys are hashed using PBKDF2 (SHA-512) and encrypted with AES-256 before touching the SQLite disk layer.

Certification status (security audit report, ISO 27001, full GDPR compliance): available on request — ask your technical architect for the current status or the expected completion date.