Many businesses assume that simply bringing the AI server in-house makes it "safe" — but physical location only solves part of the problem. A drive removed and carried out, a backup copied onto a USB stick, or an employee with broader access than they actually need — any of these can expose data even though it never "left the business" in the network sense. This is why data encryption and access control are two protections that can't be skipped.

Encryption at rest ensures that the content on disk — the AI model, the vector database holding internal knowledge, the backups — is only readable with the correct decryption key. If a drive is stolen or a backup is copied without authorization, the data inside remains meaningless to anyone without that key. This is the "in case everything else fails" layer of protection — it doesn't prevent theft of the hardware, but it prevents the content from being readable after that theft.

Encryption in transit protects data as it moves — from an employee's browser to the AI server, or between the AI server and its storage system. Even when the connection happens entirely within the company's own network, encryption (via TLS) still matters, because anyone with access to that same network segment — even accidentally — could otherwise intercept the content if it travels unencrypted.

Not every employee needs to see everything the AI assistant knows. Role-based access control (RBAC) limits the scope of knowledge each department can query: a sales employee doesn't need — and shouldn't be able — to look up HR's salary data, even if both are using the same AI assistant. Alongside that sits the audit log — a record of who asked what, and when — which lets a business review any suspicious access after the fact, and is also a requirement under many compliance standards.

DABO enables HTTPS encryption for connections by default in every deployment, and lets each sensitive document library be encrypted with its own library password — only the library manager and the people they authorize can use it; even the system administrator cannot read it — not an add-on that costs extra. Access permissions are designed around the customer's actual organizational structure from day one, and access logs are always retained to support review or compliance requirements (such as personal data protection laws) — so "security" isn't just a promise, but a specific, verifiable technical configuration.