Brane AIF Handbook

This handbook is for administrators who commission and operate a Brane AIF appliance. It covers everything from initial setup through configuration and daily operations to security, privacy, and compliance.

1. Getting Started

Your Brane AIF appliance is pre-configured and ready to use. Three steps are all it takes.

1

Connect

Connect the appliance to power (included power supply) and network (Ethernet cable to your switch or router).

2

Power On

Press the power button. The appliance boots in about 90 seconds — all services start automatically.

3

Open Browser

Open http://brane-aif.local in your browser. Alternatively: scan the QR code on the back of the appliance.

Network Requirements

Requirement	Details
Ethernet	RJ45, 100 Mbit/s or faster
DHCP	Automatic IP assignment (standard in most networks)
Internet	Optional — only needed for cloud models, tunnel and updates
Inbound Ports	None (when using Cloudflare Tunnel)
Outbound Ports	443 (HTTPS) for cloud APIs and updates
Wi-Fi	Not supported — please use Ethernet

Network Prerequisites

So your appliance is ready the moment it arrives, clarify the following network points with your IT team in advance. These are exactly the details the onboarding form asks for — so you can prepare them at your own pace. Leave anything you don’t know yet blank.

Connectivity

Two operating models are available:

Model	Meaning
Internet-routed	Outbound HTTPS for cloud models, updates and the management tunnel. Inbound ports stay closed.
Air-gapped (offline)	Fully offline. 100 % local processing, manual updates. Maximum data sovereignty.

IP Address & DNS

Out of the box the appliance gets its address via DHCP. For production we recommend a static configuration:

Field	Description	Example
Static IP	Fixed address of the appliance on your network	10.0.1.20
Gateway	Your network’s default gateway	10.0.1.1
DNS server	Internal or external resolver	10.0.1.1, 9.9.9.9
FQDN	Fully qualified name the box is reachable under	ai.your-company.com
NTP server	Time sync (important for certificates & audit logs)	pool.ntp.org

Firewall & Ports

Brane AIF has minimal requirements — typically no inbound ports need to be opened.

Direction	Port	Purpose
Inbound	—	None (with Cloudflare Tunnel). Optionally 443 internally for LAN access.
Outbound	443 (HTTPS)	Cloud APIs (if used), update registry ghcr.io, management tunnel

TLS & Certificates

Choose how the connection is encrypted (details in Network & HTTPS):

• Cloudflare Tunnel — recommended, no open port, automatic HTTPS
• Let’s Encrypt — free certificates, needs a public DNS name
• Custom certificate — from your internal PKI
• Self-signed — internal testing only

Cloud API Key (optional)

Only if you want to use cloud models: have an API key ready — easiest is an OpenRouter key (one key for all providers, see API Keys). In “Local Only” mode no key is needed.

2. Setup Wizard

On first access, the setup wizard starts automatically. It guides you through configuration in 6 steps. All settings can be changed later in the admin dashboard.

Step 1: Company

• Company Name — Appears on the login page, in chat and in the system prompt
• Company Logo — Upload your own logo (PNG or SVG)
• Language — Deutsch, English or Français
• Mode — Enterprise (with login, recommended) or Stateless (no login, for testing)

Step 2: Administrator

• Admin Email — Your login address (cannot be changed later)
• Password — Minimum 8 characters
• SSO — Optional, configure here or later (see Section 4)

Step 3: AI Configuration

The core setting: which AI models to use and how to route requests.

Local Model

Your pre-installed on-premise model is detected automatically. If not: click the refresh button or enter the model name manually.

Cloud Model (optional)

In addition to the local model, you can configure a cloud model. Choose your provider and desired model:

Provider	Recommended Model	Other Options
OpenAI	GPT-4.1 Mini	GPT-4.1, GPT-4o, o4-mini, o3
Anthropic	Claude Sonnet 4.5	Claude Opus 4.6, Claude Haiku 4.5
Google	Gemini 2.5 Flash	Gemini 2.5 Pro
Mistral	Mistral Small	Mistral Large, Pixtral Large
xAI	Grok 3 Fast	Grok 3, Grok 3 Mini

Routing Strategy

Determines how requests are distributed between local and cloud models:

• Local Only — No cloud access. No API keys needed. Maximum data sovereignty.
• Local Preferred — Local by default, cloud only for complex tasks. Best balance of security and quality.
• Cloud Preferred — Cloud for quality, local for sensitive data. Guardian protects PII automatically.
• Cloud Only — Always cloud. API keys required. PII protection remains active.

PII Policy

What happens with personal data (names, emails, IBANs) for cloud requests?

Policy	Behavior
Smart Anonymization	PII is replaced with tokens (Max Müller → <PERSON_1>), cloud sees only tokens, response is restored with original data.
Strict Blocking	Messages containing PII are never sent to the cloud. Automatic local processing.

Step 4: Departments

• Quick-start templates — General, Manufacturing, Finance, Healthcare, Legal (adds typical departments at once)
• Add manually — Any department names
• Optional: Departments can be configured later in the admin panel

Step 5: Network

• Domain — e.g. ai.your-company.com (optional)
• Certificate — Cloudflare Tunnel (recommended), Let's Encrypt, Custom or Self-Signed

Step 6: Summary

Review all settings. API keys are displayed masked. Click “Complete Setup” to finish — you will be redirected to the login page.

3. Configure API Keys

API keys connect your appliance to cloud models. Without API keys, Brane AIF works fully locally — cloud integration is optional.

Recommended: OpenRouter (1 Key = All Models)

The easiest way to connect to the cloud is OpenRouter — a universal gateway that provides access to all major providers (OpenAI, Anthropic, Google, Mistral, xAI, and more) with a single API key.

Brane AIF's OpenRouter Config (Security-First)

We automatically apply strict privacy defaults:

Setting	Value	Meaning
ZDR	opt-in	Available as a switch (Admin → Settings): when ZDR is enabled, only endpoints that don't store data are used
data_collection	deny	No training on your data
appName	Brane AIF	Correct identification in OpenRouter dashboard
usage tracking	include	Per-request cost transparency

Default model

The box ships with a curated catalog of verified models; the default model is openrouter:anthropic/claude-sonnet-4.5. On a box with EU residency, the catalog is filtered to endpoints that satisfy the data region (EU) — models without a compliant EU endpoint are not offered. openrouter/auto is deliberately not offered because the auto-router does not respect EU endpoint pinning.

EU Endpoint (Optional)

For maximum data sovereignty in Europe, you can switch to the EU endpoint. OpenRouter offers eu.openrouter.ai — data stays in the EU. Activated via cloudResidency: "eu" setting.

Set Up OpenRouter (3 Steps)

1. Visit openrouter.ai and create an account
2. Go to Settings → Keys and click “Create Key”
3. Copy the key and enter it in Brane AIF: Setup Wizard or Admin Dashboard → AI → Cloud

Alternative: Direct Provider Keys

If you prefer direct access to individual providers (e.g. for existing enterprise contracts), you can configure individual API keys per provider.

Supported Providers

OpenAI

sk-...

Create key →

Anthropic

sk-ant-...

Create key →

Google

AI...

Create key →

Mistral

...

Create key →

xAI / Grok

xai-...

Create key →

OpenRouter

sk-or-...

Create key →

Perplexity

pplx-...

Create key →

Creating an API Key

Using OpenAI as an example (similar for all providers):

1. Visit platform.openai.com/api-keys
2. Click “Create new secret key”
3. Enter a name (e.g. “Brane AIF”)
4. Copy the key immediately — it is only shown once
5. Enter it in Brane AIF: Setup Wizard (Step 3) or Admin Dashboard → Settings

Global vs. Personal Keys

Type	Configured by	Available to
Global Keys	Administrator	All users
Personal Keys	Individual user	Own account only

Recommendation: Start with a global OpenRouter key (preset “Easy”). Users can additionally add their own keys — personal keys take priority.

Security

• All keys are stored AES-256-GCM encrypted on the appliance
• The encryption key exists only on your hardware
• No data is transmitted to AI-Z or third parties
• Keys can be deleted at any time

4. Configure SSO

Single Sign-On: employees log in with their existing corporate credentials. Can be enabled in the Setup Wizard or later in the Admin Dashboard.

Supported Providers

Azure AD / Entra ID Okta Generic OIDC

Azure AD / Microsoft Entra ID

Ideal for Microsoft 365 environments.

Setup

1. Azure Portal → Azure Active Directory → App Registrations → New registration
2. Name: “Brane AIF”
3. Redirect URI (Web): https://YOUR-DOMAIN/supabase/auth/v1/callback
4. Under Certificates & secrets → New client secret
5. Enter the values in Brane AIF:

• Tenant ID: UUID of your Azure AD tenant (Azure Portal → Overview)
• Client ID: Application (Client) ID from the App Registration
• Client Secret: Secret Value (not the Secret ID)

Okta

1. Okta Developer Console → Applications → Create App Integration
2. OIDC → Web Application
3. Sign-in redirect: https://YOUR-DOMAIN/supabase/auth/v1/callback

• Issuer URL: https://your-domain.okta.com/oauth2/default
• Client ID: e.g. 0oaxxxxxxxxxxxxxxx
• Client Secret: From the Okta app configuration

Generic OIDC (Keycloak, Auth0 etc.)

1. Create a Confidential Client in your IDP
2. Redirect URI: https://YOUR-DOMAIN/supabase/auth/v1/callback
3. Scopes: openid, email, profile

• Issuer URL: e.g. https://idp.company.com/realms/main
• Client ID: Generated by the IDP
• Client Secret: Confidential Client Secret

Auto-Create Users

When enabled: users are automatically created on their first SSO login.

Login for Your Employees

After SSO configuration, the login page shows an additional button (“Sign in with Microsoft”, “Sign in with Okta”, etc.). The classic email/password login remains available.

5. User Management & Roles

Adding Users

With SSO: Users sign in directly (Auto-Create) or are approved by the admin.

Without SSO: Employees click “No account yet? Request access” on the login page and register with email and password. The administrator approves access in the dashboard.

Role System

Brane AIF supports five roles with graduated permissions:

Role	Access	Typical For
Admin	Full system access: all departments, settings, licenses, certificates	IT department
Dept Admin	Own department: users, settings, knowledge base, metering	Department head
Trainer	Chat access plus training features for onboarding and trainings	Internal and external trainers
Viewer	Read-only: audit trail, metering, compliance	Data protection officer, auditor
User	Chat with their department's rules	Employee

Admin Dashboard

Under /admin/users you can:

• Create, deactivate or delete users
• Approve or reject access requests
• Assign role from dropdown: User / Trainer / Dept Admin / Viewer / Admin
• Assign department per user
• View all users and their last login

Limits

Limit	Default	Configurable
Messages per day (signed-in)	1,000, of which max. 500 to premium/pro models	— (plus a short burst throttle if very many are sent in quick succession)
File uploads per day	500	No (fixed default)

6. Departments

Departments are a lightweight way to group your users — scalable, without a maze of per-group dials. A department bundles members, manages its department admins, and can optionally be run as a pure on-premise group. The actual protection behavior (routing, PII, company rules) is governed centrally in the Perimeter (chapter 12) — not per department — so the data boundary stays verifiable in one place.

Create Department

Under /admin/departments you create and manage departments:

1. Enter a name (e.g. "HR", "Engineering", "Legal")
2. Optionally a short description
3. Optionally enable the "Local only" switch (local_only)

The one policy switch: "Local only"

When "Local only" is on, every request from that department's members stays on the box — no cloud model, regardless of the global routing setting. This is deliberately the only department-level dial: an air-gap group for especially sensitive areas. There are no per-department overrides for routing mode, PII policy, cloud model or data policy anymore — those levers live centrally in the Perimeter (chapter 12).

Members & department admins

On the department page you view and manage members directly (add / remove). To let someone run a department on their own, give them the Dept Admin role in User Management (chapter 5) — roles are assigned there, not duplicated in the department view. Deleting a department is blocked while it still has members assigned.

7. Data Retention

GDPR Art. 5(1)(e) compliant (storage limitation). Configure how long chat data is retained.

Three Modes

Mode	Behavior	Recommended For
Forever	All chats stored indefinitely	Development, internal tools
Auto-Delete	Chats deleted after N days (configurable: 1-3650)	Standard enterprise use
None (Ephemeral)	Messages in browser only, no database	HR, Legal, sensitive areas

Ephemeral Mode — Strongest Privacy

In ephemeral mode, no messages are stored — neither in the database nor in the audit log. The user sees a notice in the chat: "This chat is not saved". When the browser closes, the conversation is gone.

Legal: Ephemeral is the GDPR gold standard (data minimization Art. 5(1)(c)) and meets EU AI Act Art. 50 (transparency). No retention obligation for general AI chats in Germany.

Recommendations for Choosing a Mode

The retention mode applies globally to the whole box — the only per-department switch is "Local only" (chapter 6). As organizational guidance on which mode fits which content:

• HR-heavy usage: Ephemeral (salary talks, applications — disappear immediately)
• Engineering-heavy usage: 90 days (code reviews, technical questions — short history)
• Legal-heavy usage: Forever (contract reviews — audit-compliant)

8. Daily Operations

8.1 Admin Dashboard

Under /admin you can see at a glance:

• System Status — Operational / Degraded / Error + Uptime
• Registered Users — Number of active accounts
• Database Status — Online/Offline
• Local LLM — Ready/Offline + model name
• Guardian Policy — Routing mode and PII policy

8.2 Changing Settings

All Setup Wizard settings can be changed later in the Admin Dashboard under /admin/settings:

• Switch routing mode & PII policy
• Change local or cloud model
• Add or remove API keys
• Enable/disable SSO
• Adjust PII detection level

8.3 Network & HTTPS

For access outside the local network and HTTPS encryption:

Cloudflare Tunnel

Zero-config HTTPS. No ports to open. Create a tunnel token at dash.cloudflare.com → Zero Trust → Tunnels and enter it in the admin settings.

Let's Encrypt

Free certificates. Requires ports 80/443 open and DNS pointing to the appliance.

Custom Certificate

Your own .crt/.key from your PKI.

Self-Signed

Internal/test only. Browser will show warnings.

9. Backup & Updates

Creating Backups

Brane AIF creates automatic backups. We additionally recommend regular manual backups to external media.

Updates

Updates are managed by AI-Z: we deliver signed images and install them remotely — for air-gapped boxes, installation happens on site. Before every update you receive advance notice along with customer-readable release notes. After installation the appliance restarts automatically (downtime: under 1 minute).

All data, settings and API keys are preserved during updates.

10. Security Architecture

Six interlocking security layers protect your data — automatically, without manual intervention.

Architecture

Your Browser | Reverse Proxy — HTTPS & Certificates ───── :443 | Web App — Chat Interface & Admin ────── :3000 | | Guardian Core Database PII · Routing · Audit PostgreSQL + RLS + Vector Search | vLLM — Local AI Processing | GPU Inference

Guardian Core — Automatic Data Classification

Every user message passes through the Guardian before processing. It decides in real-time: process locally, send to cloud with anonymization, or block.

Phase 1: Hard Constraints (< 1 ms)

• Image content is extracted locally and checked like text — sensitive findings force local processing
• Chat already sensitive? → LOCAL (Conversation Lock)
• Mode = Local Only? → LOCAL
• No cloud API key? → LOCAL

Phase 2: PII Detection (< 200 ms)

• Regex scan (23 categories) + ML scan (NER model, local) + LLM scan (context-based)

Phase 3: Routing Decision

• No PII found? → Cloud allowed
• PII + policy "Block"? → LOCAL enforced
• PII + policy "Anonymize"? → Cloud with anonymization
• Uncertainty? → LOCAL (fail-safe)

Detected PII Categories (23 Types in 7 Groups)

Group	Categories	Detection
Identity	Person names, dates of birth, passport & social security numbers	AI + Regex
Contact	Email, phone, postal addresses	AI + Regex
Financial	IBAN, account numbers, credit cards	Regex
German enterprise IDs	Tax numbers, VAT IDs, trade register, insurance numbers	AI + Regex
Digital	Passwords, API keys, IP addresses	Regex
Organization & context	Company names, sensitive business context	AI
Special categories (Art. 9 GDPR)	Health data, political opinion, religion, ethnic origin	AI

Smart Redaction — Pseudonymization

When data is sent to a cloud provider, it only sees typed tokens — never original data.

INPUT (user):
  "Please contact Max Müller at max@company.com, IBAN DE89 3704 0044 0532 0130 00"

AFTER ANONYMIZATION (what the cloud sees):
  "Please contact <PERSON_1> at <EMAIL_1>, IBAN <IBAN_1>"

AFTER REHYDRATION (what the user sees):
  "I have contacted Max Müller at max@company.com."

In-Memory Mapping — encrypted at rest

The mapping between token and original value lives in memory. For cross-turn consistency it is additionally stored AES-256-GCM-encrypted and is removed when the chat is deleted or by the data-retention job.

Cross-Message Consistency

Within a conversation, the same PII value always receives the same token. max@company.com → always <EMAIL_1>.

Rehydration < 5 ms

Bidirectional O(1) lookups. No ML model involved. Fuzzy matching for AI-modified token formats.

Overlap Protection

max.mueller@gmail.com is not simultaneously detected as PERSON and EMAIL — the most precise category wins.

Encryption

Layer	Standard	What is protected
Database (at rest)	AES-256-GCM	API keys, user keys, sensitive configuration
Network (in transit)	TLS 1.2/1.3	All connections between client, application, database
Database access	Row Level Security	Each user sees only their own data — enforced at database level
Key management	Environment Variables	Encryption keys never in the database — only as environment variables

Data Isolation

Physical Isolation

All data on local infrastructure. AI inference runs locally. System works completely without internet (air-gap capable). No telemetry upload.

Logical Isolation

Row Level Security: each user sees only their own data. RBAC: strict separation of Admin/User/System. Multi-tenant; user and stream capacity depends on the license tier (see FAQ).

Audit & Traceability

Every routing decision documented (Local/Cloud, reason, flags). Audit logs are immutable — cannot be modified after the fact. No PII in the logs.

Right to Erasure

Cascading Deletes: when a user deletes their account, all messages, documents and vectors are irrevocably removed.

11. Admin Controls & Policy Tester

The administrator controls all protection behavior through five cascading controls. No code, no terminal — everything via the Admin Dashboard.

Decision Hierarchy

Routing Strategy              "May the cloud be used at all?"
└─ AI Interaction Firewall    "Is this content sensitive?"
   ├─ Detection Sensitivity   "How strictly to judge?"
   ├─ Enterprise Policy       "What special rules does the company have?"
   └─ PII Cloud Policy        "What to do when sensitive? (Block vs. Anonymize)"

Control	What the admin sees	What happens internally
Routing Strategy	4 modes: Local Only → Local Preferred → Cloud Preferred → Cloud Only	Determines whether cloud is even a valid target
Detection Sensitivity	Low / Standard / High	Changes the instruction to the AI. At "High": "Be extra cautious — better one false positive than a miss."
Enterprise Policy	Free text in natural language	Company policy is directly embedded in the AI instruction — contextual understanding
PII Cloud Policy	Anonymize vs. Block	What happens after sensitive data is detected

Enterprise Policy — Company-Specific Rules

The Enterprise Policy is the most powerful control. Instead of predefined categories, the company describes in natural language what is sensitive. The AI interprets these rules contextually for every message.

Financial Services

"Financial data (revenue, costs, margins, forecasts) as well as client names and portfolio data must never leave the box under any circumstances. Regulatory inquiries (BaFin, MaRisk) must always be processed locally."

Automotive Supplier

"All information about Project Aurora, part numbers (format: XX-YYYY-ZZZ), tooling data and OEM correspondence is confidential. General technical questions may use the cloud."

HR Services

"Applicant data, salary information, employee reviews and internal org charts are always sensitive. General HR questions about labor law may use the cloud."

Research Institution

"Unpublished research results, patent applications and grant proposals are strictly confidential. Literature research is unproblematic."

Integrated Policy Tester

The admin doesn't have to guess whether their policy works. Right in the dashboard there is a Policy Tester that executes the real Guardian pipeline.

Step 1: Write & save the policy — Enterprise Policy: "Financial data must never leave the box" · Sensitivity: High · PII policy: Anonymize

Step 2: Enter a sample message & test — e.g. "Our revenue was 4.2M EUR in Q3"

Step 3: Read the instant result — PROCESSED LOCALLY · Reason: Enterprise Policy (financial data) · Flags: sensitive_context · Settings: cloud-preferred, High, Anonymize

Recommended Setup Workflow

1. Routing Strategy — for most companies: Cloud Preferred
2. Detection Sensitivity — High for regulated industries, Standard for general use
3. Enterprise Policy — formulate company-specific confidentiality rules in your own words
4. Policy Tester — test 5–10 typical messages (sensitive + harmless)
5. PII Cloud Policy — Anonymize for maximum cloud usage with full protection
6. Release the system to employees

Web Search: On-Box or External

With web search enabled, choose the search backend under Admin → AI & Cloud → Web Search. The on-box search (SearXNG) runs as a sovereign metasearch directly on the appliance — queries go to the search engines without any account or user context. Alternatively, Exa is available as an external semantic search service (US); detected personal data is stripped from the query before it leaves the box. In both cases the assistant marks web-search-based statements with numbered source references [1], [2] … that map to the displayed source list; depth mode researches deeper — more sources and fuller content per search.

12. Perimeter — Your Data Boundary at a Glance

The Perimeter (under /admin/perimeter) answers, on a single screen, the question every auditor and works council asks first: "What leaves this box — to whom, under which conditions?" It gathers the data-boundary levers that used to be scattered across several tabs into one place — governable and provable.

Plain-language summary

At the top, the current posture is stated in full sentences, generated live from the real settings (not hand-written, so it can never diverge from reality). For example: "Personal data is tokenized before the cloud · All detectors are active · When in doubt, everything stays local · Outbound traffic only to preset provider hosts." Change a lever below and the sentence re-writes itself immediately.

The three lever cards

Card	What you control
Egress & Region	Routing mode, web-search policy, cloud region (EU/US/global — enforced on the OpenRouter path) and the allowlist of permitted target hosts
PII Protection	Block vs. Anonymize, and the detection sensitivity
Company Rules	The active company rules (Cognitive Judge) — read-only here, plus a prompt tester that runs a sample message through the real Guardian pipeline and shows LOCAL / CLOUD / ANONYMIZED

How sensitive data in the response is handled (output DLP) follows the PII policy automatically: "Anonymize" → redact, "Block" → block. There is deliberately no separate lever — and no "off".

Hard-wired — trust through guarantees

Below the levers is a strip of what cannot be switched off: all PII detectors always run, any error/timeout/uncertainty is processed locally (fail-safe-to-LOCAL), and the Cognitive Judge cannot be disabled. A hard refusal (“not processed for security reasons”) is issued only on a block verdict with high confidence — in unclear cases the box answers normally but strictly locally, so nothing unsafe ever leaves the box. The principle of the whole screen: control the policy, lock the mechanism.

Perimeter Statement (export)

One click produces a dated, printable document (German + English) with exactly the same sentences as the summary, a full lever table, and the hard-wired guarantees — for auditors and the works council. No secrets (no keys, no tokens) appear in it.

13. Cloud Providers & Data Policies

When you add an API key, the box communicates directly with the cloud provider. Here is what providers contractually guarantee — and where the limits lie.

OpenAI (GPT-4o, GPT-5, o3, etc.)

Aspect	Details
Training with API data	No — no training with API data by default
Data retention	30 days — inputs & outputs for abuse monitoring
Zero Data Retention	Available for Enterprise customers on request (not standard)
Staff access	Authorized employees + third parties may access data upon abuse suspicion
Data location	US (default). Europe optional for Enterprise (since 2026)
DPA	Data Processing Addendum available (updated Jan 1, 2026)
Special risk	Court Order — OpenAI disclosed in 2025 that a court order required retention of certain API data

Anthropic (Claude Opus 4.6, Sonnet, Haiku)

Aspect	Details
Training with API data	No — Commercial Terms explicitly prohibit training
Data retention	7 days — API logs automatically deleted after 7 days (since Sep 2025)
Zero Data Retention	Available for Commercial API customers
Consumer vs. Commercial	Caution — Claude Pro/Team (Consumer) trains with user data by default. Only API customers are exempt.
Data location	US. EU hosting via Amazon Bedrock or Google Vertex AI
DPA	Commercial Terms with explicit training prohibition

Google (Gemini 2.5 Pro, Flash, etc.)

Aspect	Details
Training with API data	No — Paid API does not use data for training
Data retention	55 days — prompts & outputs for abuse monitoring
Free API tier	Caution — The free tier may use data for training
Zero Data Retention	Available on Vertex AI (Google Cloud)
Data location	Configurable via Google Cloud regions (incl. EU)
DPA	Google Cloud Data Processing Addendum (CDPA)

Comparison at a Glance

	OpenAI	Anthropic	Google
Training	No (default)	No (Commercial)	No (Paid)
Retention	30 days	7 days	55 days
ZDR available	Enterprise only	Commercial API	Vertex AI
EU hosting	Enterprise (2026)	Via Bedrock/Vertex	Vertex regions
DPA	Available	Available	CDPA

Why "Policy by Hardware" is Superior

Contractual Assurance (Cloud-only)

• Providers promise not to use data
• Data is still stored for abuse monitoring
• Court orders can force retention
• In a data breach, PII is affected

Technical Enforcement (Brane AIF)

• Detected PII is protected by anonymization; in "Local only" mode, nothing leaves the box at all
• Abuse monitoring contains only tokens without personal reference
• Court orders only affect placeholders
• Compliance evidence is fully with the customer

14. Compliance & GDPR

GDPR Mapping

Requirement	Implementation
Art. 32(1)(a) — Pseudonymisation	Smart Redaction with typed tokens
Art. 32(1)(a) — Encryption	AES-256-GCM at rest, TLS in transit
Art. 32(1)(b) — Confidentiality	Guardian routing, PII detection, Conversation Lock
Art. 32(1)(b) — Integrity	Immutable Audit Log, Row Level Security
Art. 32(1)(d) — Testing	Policy Tester, Audit Logs, OpenTelemetry
Art. 17 — Right to Erasure	Cascading Deletes incl. vectors
Art. 25 — Privacy by Design	Local-first architecture, fail-safe to local
EU AI Act — Transparency	Model labeling, routing rationale in UI

TISAX Compatible

In high-confidentiality mode, the system enforces local processing for configurable keywords. Fully air-gap capable — no internet required.

EU AI Act Ready

AI-generated content is labeled in the UI including model specification (Local vs. Cloud). Routing decisions are traceable and auditable.

Post-Setup Security Checklist

	Action	Priority
☐	Default passwords changed (database, admin account)	Critical
☐	Encryption key and JWT secrets regenerated (min. 32 bytes)	Critical
☐	TLS certificate installed and HSTS enabled	Critical
☐	Network: only port 443 externally, internal services isolated	High
☐	Routing mode and PII policy configured	High
☐	Enterprise Policy formulated and validated with Policy Tester	High
☐	Regular updates scheduled (monthly)	High
☐	Audit logs reviewed regularly	Standard
☐	Backup strategy defined and tested	Standard
☐	SSO configured (if desired)	Optional
☐	Detection Sensitivity set to "High" for regulated industries	Optional
☐	Air-gap mode enabled (if no internet desired)	Optional

15. Customization & Branding

Every Brane AIF appliance can be fully tailored to your organization. We accompany you from initial planning through deployment to ongoing operations.

Company Branding

Your company logo on the login page, in the chat header, and in the setup wizard. Custom color scheme to match your corporate design. Custom domain (e.g. ai.your-company.com) with managed TLS certificates.

Custom AI Configuration

Pre-configured routing strategy and PII policies tailored to your industry. Custom Enterprise Policy pre-written by our team based on your compliance requirements. Model selection optimized for your use cases (speed vs. quality vs. multilingual).

SSO & Directory Integration

We configure Azure AD, Okta or your OIDC provider end-to-end. Group-based access control, automatic user provisioning, and role mapping. Test and validate the complete authentication flow before go-live.

Network & Infrastructure

On-site or remote installation in your data center or server room. Network configuration including Cloudflare Tunnel, custom DNS, and firewall rules. Integration with your monitoring stack (SNMP, Prometheus, Grafana).

Training & Onboarding

Administrator training: routing configuration, PII policies, user management, audit logs. End-user workshops: effective prompting, document upload, project workspaces. Dedicated support contact during the rollout phase.

Knowledge Base & RAG

We help you build your company knowledge base: document ingestion, vector indexing, and retrieval tuning. Connect internal wikis, SharePoint, or file shares so the AI can answer questions about your company data — all processed locally.

Ongoing Support & SLA

Monthly health checks and proactive monitoring. Priority support with guaranteed response times. Regular security updates and model upgrades. Quarterly business reviews with usage analytics and optimization recommendations.

16. Troubleshooting

Appliance not reachable in browser

• Computer and appliance on the same network?
• Ethernet cable plugged in? LED on port active?
• Try the IP address directly (Router → Connected Devices → “brane-aif”)
• Let the appliance run for at least 90 seconds after powering on

Setup Wizard doesn't appear

The wizard only shows on the very first access. If the appliance has already been set up, you will land directly on the login page.

Local model “Offline”

The local model needs 1–3 minutes to load after startup. Wait and refresh the page. If the problem persists: contact support.

SSO login not working

• Redirect URI correct? Must be exactly https://YOUR-DOMAIN/supabase/auth/v1/callback
• Client Secret still valid? (Azure Secrets expire after 6/12/24 months)
• User assigned to the IDP application?

Slow responses

With many concurrent users, response time may increase. This is normal — the appliance prioritizes automatically. If performance is consistently poor: contact us for a hardware upgrade.

17. IDE & Developer Integration

IDE AI extensions talk to cloud services by default. Because Brane AIF exposes an OpenAI-compatible API, common developer tools can be redirected to the local box — your code stays in-house.

Recommended: IDE chat (Cline / Roo Code / Continue)

1. Install the Cline extension (or Roo Code / Continue) in VS Code.
2. Choose the “OpenAI Compatible” provider.
3. Enter the endpoint URL and API key, select a model.

IDE chat then runs entirely through the box. Agentic coding (reading files, editing, solving tasks) requires tool calling (tools/tool_calls) — the gateway does not support this yet; it is on the roadmap.

GitHub Copilot (chat only)

Via Manage Language Models → OpenAI Compatible you can redirect Copilot's chat mode to Brane.

Claude Code

The box exposes only the OpenAI-compatible gateway — an Anthropic-native endpoint is not available. Tools that speak the OpenAI API can connect.

Other clients

Aider, opencode, and your own apps/SDKs work with the same endpoint URL and API key.

Listing available models

To see which models the box offers, call GET /api/v1/models — OpenAI-compatible, using the same API key (bearer token) as chat. Handy for letting tools populate the model picker automatically.

curl https://api-brane.company.com/api/v1/models \
  -H "Authorization: Bearer <API-KEY>"

18. FAQ

Do I absolutely need cloud models?

No. In “Local Only” mode, everything runs on your hardware. No internet connection, no API keys. Full functionality including chat, document upload and RAG.

Can I change the AI model later?

Yes, at any time via Admin Dashboard → Settings. Local and cloud models are independently configurable. No restart required.

How many concurrent users?

Depends on your license tier: Starter (5 users, 8 parallel streams), Professional (25 users, 32 streams), Business (100 users, 128 streams), Enterprise (unlimited users, 512 streams). Each user has fully isolated data.

Can I enable SSO later?

Yes. SSO can be enabled, changed or disabled at any time in the Admin Dashboard. Existing user accounts are preserved.

What happens during an update?

Updates are delivered by AI-Z as signed images and installed remotely — on site for air-gapped boxes. You receive advance notice and release notes. All data, settings and API keys are preserved. Downtime: under 1 minute.

Is Brane AIF GDPR-compliant?

Yes. In Local Only mode, no data leaves your infrastructure. In hybrid modes, PII is automatically anonymized or blocked. Audit logs document everything — without storing PII.

How do I back up my data?

Automatic backups are stored locally. We additionally recommend regular backups to external media. Details in the “Backup & Updates” section.

Multiple cloud providers at once?

Yes. You can add keys for all 7 providers. The default model determines the primary provider. Users can add their own keys for alternative providers.

Does the appliance need internet?

Only for cloud models, Cloudflare Tunnel and updates. In Local Only operation: no internet needed. The appliance works fully offline.

Questions?

Our team is happy to help.

Contact Support