Product / Security and control
Governed access to documents, for people and for AI agents.
In short
troveGEN applies access rules inside every search, masks sensitive identifiers before indexing, records an audit trail, and deletes a document together with everything derived from it. You can run it managed, with your own vector database and models, or fully offline.
Who can see what
Permissions in the query
Restricted passages are removed before ranking. Rules combine with filters, so a filter can never widen access.
Signed end-user assertions
Your application signs who the end user is and which groups they belong to; troveGEN verifies the signature and can require it.
Groups and inheritance
Sync your group hierarchy and a team inherits its parent group’s access.
Roles and project access
Owner, administrator, developer and user roles. Limit a person to chosen projects; their API keys follow the same limit.
Scoped API keys
Keys carry named scopes, can be limited to chosen projects, and are revoked at once.
What is stored
Sensitive data masked
Account numbers, national IDs, card numbers and similar identifiers are tokenised before indexing, with the originals in an encrypted vault revealed only to permitted callers.
Encrypted credentials
Connector and model credentials are sealed with AES-256-GCM, never returned, and support key rotation.
No training on your data
Documents and questions are never used to train models.
Proof and removal
Audit trail
Sign-ins, setting changes and deletions are recorded in an append-only log that owners and administrators can read.
Deletion that deletes
A document delete removes its passages, vectors, tables, figures, graph entries, test questions and chat citations, and returns a receipt of what went.
Retention
Audit events, usage records and sessions are purged on a fixed schedule, with the totals kept exact.
Sign-in and deployment
Single sign-on
OpenID Connect and SAML 2.0 sign-in with SCIM provisioning are available for Sovereign installs.
Your database, models and keys
Use Qdrant, Pinecone, pgvector or Postgres that you run, and your own models, so vectors and calls stay with you.
Fully offline
Sovereign installs run with no outside calls, from a signed offline licence, with backup and restore included.
Deploy in your region
Run the same package in the region your data must stay in.
How a restricted document stays restricted
Label
The document carries who may see it.
Verify
The caller’s identity and groups are checked, and signed when you require it.
Filter
Search removes passages the caller may not see before ranking.
Record
The request lands in the audit trail.
Questions people ask
How does troveGEN enforce document permissions?
Access rules are applied inside the search query, before ranking, using the caller’s verified identity and groups. A restricted passage is not retrieved at all, so no wording of a question can surface it.
Is sensitive data stored in the index?
No. High-risk identifiers are replaced with tokens before indexing, on every plan, and the originals are kept in a separate encrypted vault.
Does troveGEN support SSO?
Sovereign installs support OpenID Connect and SAML 2.0 sign-in and SCIM provisioning. Hosted workspaces sign in with email and password.
Can it run fully offline?
Yes. A Sovereign install runs with local models and no outside calls, licensed by a signed file that needs no internet connection.
What happens to derived data when I delete a document?
Everything built from it is removed in the same operation, and you receive a receipt listing what was removed.
Last updated 2026-10-26. Figures are from troveGEN’s own tests on the dates given; ask us for the method.
Talk to us about your review.
We can walk your security team through the controls above.