The situation we usually begin with
The conversation rarely begins with a question about AI. It begins with a prohibition or a question that has no good answer. Someone has checked what employees paste into public tools. A customer has sent a security questionnaire asking how AI processes their data. The legal team has stopped an idea because no one knows where the documents go.
This reveals that one issue touches several things at once: where the data is processed, who has access, the condition of the company's existing infrastructure, and whether all of this can be demonstrated to an auditor or customer.
Data that cannot leave the organisation
Contracts, technical documentation, case files, personal data and medical records. The most labour-intensive document processes are often the hardest to address.
AI entered the company without a decision
Teams already use public tools because they are readily available. No one has defined what is permitted, and the company discovers this during an audit or after a customer asks.
You need to demonstrate how it works
A regulator, auditor or customer asks about processing locations, access and responsibility. “We use an AI tool” is not a sufficient answer.
When a closed environment is necessary
A closed environment is not a better version of an AI implementation. It is the version selected when there is a constraint that cannot be avoided.
The restriction comes from regulation
Industry regulations, professional secrecy and requirements for public or regulated organisations. There is little room for interpretation and this usually settles the matter fastest.
The restriction comes from a contract
Confidentiality clauses, customers' supplier requirements and tender security questionnaires. The company may be technically able to proceed but unwilling to accept the contractual risk.
The restriction comes from a company decision
A board-level security policy that cannot be negotiated for an individual project. This is a valid reason even when no regulation prohibits external processing.
What this area covers across the Group
We address two strands that are difficult to separate in practice: the environment in which AI can work with company data, and the security and compliance of the infrastructure supporting it.
An environment for confidential data
Designing and launching an environment where AI works with documents and operational data without sending their contents to an external model provider. We adapt the setup to what you already have and what your data requires.
Infrastructure security
Audits, procedures and adapting the IT environment to requirements including NIS2 and DORA. We deliver this area independently of whether AI forms part of the project.
AI implementation compliance
Defining usage rules, responsibilities and the documentation required by auditors, customers or authorities, including obligations under the AI Act.
Who leads such a project
Two Group companies work in this area. Whether the environment must first be built or only a solution deployed within it determines who leads.
GOTOMA GENERAL
Leads when the environment must be designed and built: deployment model, hardware and computing capacity, security, compliance and investment financing. It also delivers audits and security procedures unrelated directly to AI.
Private AI and local environments at GOTOMA GENERAL ›GOTOMA Software House
Becomes involved when the solution itself is being created: an assistant, document workflow or process automation. If you already have a suitable environment, the project may remain entirely with this company.
AI for documents and processes at GOTOMA.pl ›You do not need to decide this before the conversation. Describe the data involved and what currently prevents its use, and we will divide the work internally.
What we do not promise
We do not claim absolute security or promise that data can never leak. A closed environment does not make a solution secure by itself, and an unsupported promise leads to the conversation no one wants to have after an incident.
Instead, we define and document verifiable facts: where data is processed and what does not leave the environment, who can access what, what can later be reconstructed, and who is responsible – including when something goes wrong.
The same principle applies to AI mechanisms. They operate with high, but not absolute, certainty, so we define in advance what happens automatically and what requires human approval. Decisions involving professional responsibility, including accounting, tax, legal and medical decisions, remain with the responsible people. We treat this as a design principle, not a configuration setting.