It runs in your own Azure.
aidi.ai installs in your own Azure subscription as a managed application. This page sets out where your data goes, who can reach it and what you control.
Your Azure subscription
- Microsoft FabricYour data, with row-level security for each person
- aidi.aiAnswers and charts, and each person's encrypted copy
- Microsoft FoundryYour own AI model
- Admin consoleWho may sign in, which models, updates
Off until someone turns it on: Claude or OpenAI, if your admin adds them · a person's own AI key, if you allow it · the desktop's link to other AI assistants
- Each person gets only the rows your Fabric row-level security allows them. Their copies stay in your subscription and on their own devices, encrypted.
- Answers come from your own AI model in Microsoft Foundry, reached with the installation’s own Azure identity, so there is no key to store.
- People sign in with their Microsoft work account.
- No standing access from outside your organisation. Updates run only when you start them.
- No usage or crash reports. Anything else that leaves your subscription is off until someone turns it on.
Voice is not yet part of the installation in your own Azure subscription.
Where each copy is kept
| Where | What | How it is protected |
|---|---|---|
| Microsoft Fabric | Your data, the source | Read as each person, so your row-level security applies |
| Your Azure subscription | Each person’s copy of what Fabric returned for them, and their conversations | Encrypted, each person’s copy under its own key, protected by your Key Vault |
| Laptops, with the desktop app | The person’s own copy and their conversations | AES-256 at rest; the key in Windows or macOS secure storage |
| Phones and iPads | The five most recent conversations; no data engine | Encrypted, outside backups; the app locks when you step away |
| Claude or OpenAI, only if added | The conversation and the query results an answer needs | The provider’s terms; OpenAI calls are sent with storage off |
Questions people ask
Where does it run?
In your own Azure subscription, as an Azure managed application, in the region you choose. The engine, each person’s copy of their data and their conversations are kept there.
Where does our data go?
aidi.ai reads your data from Microsoft Fabric as each person, so the row-level security on your Fabric data decides what each person gets. Each person’s copy is kept encrypted in your subscription, under its own key, which your Key Vault protects. If someone uses the desktop app, their copy is also kept on their laptop, encrypted.
How does row-level security work?
It is set on the Fabric endpoint aidi.ai reads: a warehouse security policy, a lakehouse endpoint in delegated mode, or OneLake security roles. The roles in a Power BI semantic model are not used for answers.
Setup creates the rules for each person and tests them with someone who should see only part of the data.
Do we need another AI contract?
Not for the models Microsoft sells in Microsoft Foundry. aidi.ai signs in to your Foundry resource with the installation’s own Azure identity, so no key for it is stored.
Claude and OpenAI come with their own provider’s terms, which your admin accepts when adding them. Their keys stay in your installation’s Key Vault. You choose the default model and which models people can pick, and you can turn off people’s own keys in the desktop app.
How do people sign in?
With their Microsoft work account. Your Conditional Access and multifactor rules apply at sign-in. Turn on Assignment required to limit it to the people you assign.
Who else can get in?
No one keeps standing access from outside your organisation. Setup, and each update you start, opens access to the installation’s resource group for that run only, then closes it. Your admin console tells you if it is still open. Your subscription’s role assignments show who can reach it.
What is kept on phones and laptops?
Phones keep the five most recent conversations, encrypted and outside backups, and the app locks when you step away. The desktop app keeps a copy of the person’s own data, only what they may see, and their conversations, encrypted at rest with AES-256.
Signing out erases what a device keeps, and so does disabling the person’s account.
What leaves our subscription?
aidi.ai sends no usage or crash reports. Data leaves your subscription only on a path someone turns on:
- a model from another AI provider, such as Claude or OpenAI, if your admin adds one. It receives the conversation and the query results the answer needs;
- a person’s own AI key in the desktop app, if you allow own keys;
- the desktop app’s link to another AI assistant, which each person turns on after agreeing to it.
What happens when someone leaves?
Disable their account. The desktop app then erases its copy the next time it checks the sign-in, the phone erases what it keeps, and the installation stops refreshing their data.
How do we roll it out?
Send people a link or a QR code. For the desktop app, IT can also set it up centrally. An admin console shows the service’s health, who may sign in, approvals and updates.
What do we need to start?
An Azure subscription, your data in Microsoft Fabric with row-level security for each person, and an AI model: your own in Microsoft Foundry, or Claude or OpenAI.
What happens if we stop?
Delete the managed application. That removes its resource group and everything aidi.ai kept in your subscription. Its Key Vault keeps the keys recoverable for your retention period, then they are gone.
Who processes what
- Microsoft runs your installation, Microsoft Fabric, sign-in and the models sold in Microsoft Foundry, under your own agreements with Microsoft.
- Anthropic or OpenAI, only if your admin adds them. Claude on Microsoft Foundry also counts as Anthropic.
- Vizlake’s setup service sees what setup and updates need: the installation’s state and your organisation’s name. It does not receive your data.
Certification
Vizlake Analytics Private Limited, which makes aidi.ai, holds an ISO/IEC 27001:2022 certificate for its information security management system (registration ISMS/20/R91/2246, issued by Certification Partner Global and accredited by JAS-ANZ). The certificate covers Vizlake’s services; it is not a certificate of the product.
For your review
We send the data processing agreement, the list of sub-processors, our ISO 27001 certificate and answers to your security questionnaire on request. Write to info@vizlake.com.
Ask for a demo.
We ask it the kind of questions you would, on a sample company, typed and spoken, and show you where it runs in your Azure.
Or write to info@vizlake.com
aidi.ai
Clarity for every decision
Powered by Vizlake Phoenix