# Deployment, data and access security

> AskDona runs as managed SaaS or as the same SaaS inside the customer's own AWS or GCP cloud; customer data is isolated per organization and is not used to train AI models.

- Status: Current. Last verified 2026-10-11.
- Canonical: https://askdona.com/ai/deployment-and-security.md
- Sources: https://askdona.com/en/security/, https://askdona.com/en/content/updates/2026-06-27-access-control/

## Deployment options

- **Managed SaaS:** operated by AskDona; fastest to start.
- **SaaS hosted in the customer's own cloud:** the same AskDona, shipped as Docker images and deployed into the customer's contracted AWS or GCP environment, so data stays inside the customer's security boundary. Same features and update cadence as the managed SaaS.
- Some capabilities may vary with the deployment environment and model configuration.

## Data protection

- **Isolation:** in the SaaS deployment, each organization's data is logically isolated based on login credentials.
- **Model training:** AskDona only adopts LLMs whose terms state that API input and output are excluded from model training; customer data is not used to train models such as ChatGPT.

## Access control (added June 2026)

- Organization-wide usage restrictions that enforce company policy.
- Custom, role-based permissions per feature, assignable per member or through teams.
- Per-document confidentiality levels that control who can reference each document.
- Audit logs of access-setting changes, and an administrator dashboard with usage, configuration changes and a traceable audit trail of user activity.