---
title: "Organization security: AI models, tools and EU processing"
description: "Choose which AI models, research tools and outside services your Biocompile organization may use, keep AI processing in the EU and preview every policy change."
url: https://www.biocompile.com/docs/organization-security/
section: "Organizations and security"
last_updated: 2026-10-23
app_url: https://app.biocompile.com/organization
---

# Organization security: AI models, tools and EU processing

> Choose which AI models, research tools and outside services your Biocompile organization may use, keep AI processing in the EU and preview every policy change.

Source: https://www.biocompile.com/docs/organization-security/. Index of all Biocompile documentation: https://www.biocompile.com/docs/index.md

Biocompile's organization security policy decides which model deployments, tools,
pipelines and outside services people in an organization may use, and where their data
may be processed. Organization owners and admins set it under **Organization → Security**,
and each member can add stricter limits for themselves. Access to a resource and access to
its destination are evaluated together against the current rules.

The summary at the top of **Organization → Security** shows the current rules and their
version, how many research tools are on, and the setting for **Internet access for code**.

## Choose a starting point

Open **Organization → Security** and find **Starting point**. Each option fills in the
choices below it; they are not special modes, so you can change any choice afterwards.

| Starting point | What it fills in |
|---|---|
| **Recommended** | Allows the outside services Biocompile has reviewed, wherever they process data. |
| **EU only** | Allows only the reviewed services that process data in the EU, and sets **Where data may be processed** to `eu`. |
| **No outside services** | Allows no outside services. |

Every starting point sets **Internet access for code the assistant runs** to **Only
selected websites and services** and leaves services Biocompile has not reviewed off.

To keep processing in the EU without changing anything else, switch on **Keep AI
processing in the EU**, or enter region codes such as `eu` under **Where data may be
processed**. A service is allowed only if every place it may process data is on the list.
Models and services that cannot confirm an allowed location are blocked, and background
tasks switch to EU-hosted models automatically.

Two more switches sit beside it:

- **Allow providers added in this workspace** lets connections your organization set up,
  such as your own model endpoints, be used. Each one must also be allowed under
  **Providers** and switched on under **Tools and integrations**.
- **Allow services Biocompile hasn't reviewed yet** is off by default. Turn it on only if
  you need a service that has not been reviewed.

### Example: keep AI processing in the EU

A team whose contracts require EU processing applies the policy once for everyone:

1. Choose **EU only** under **Starting point**. Result: **Keep AI processing in the EU** is
   on, and the page shows **Unsaved changes**.
2. Enter a reason under **Reason for the change**, such as "Customer contracts require EU
   processing".
3. Choose **Preview what changes**. Result: the preview lists the resources that are newly
   blocked, such as models that run outside the EU.
4. Choose **Apply version**. Result: models and services that cannot confirm an EU location
   are blocked for everyone in the organization.

## Choose what is allowed

The page lists what the rules cover, in this order:

- **Background models** are the models Biocompile uses behind the scenes for titles,
  summaries and choosing a model. You can choose a model for each task under
  **Your choice**; if the rules do not allow it, the default is used. A task with no
  allowed model is skipped.
- **Providers** are outside services that may receive your research data. Use **Add your
  own provider** to describe an address you use. It is shown as added in this workspace,
  not as reviewed by Biocompile.
- **Tools and integrations** lists each integration with its models, tools, pipelines and
  research features. Open one to switch items on or off. Some recommended items are on by
  default, and your own choice always wins.
- **Optional Biocompile services** are services Biocompile runs for you that you do not
  have to use. Turning one off stops it for everyone in the organization.

Allowing a provider is not enough on its own: the tools that use it must also be switched
on.

### Internet access for code

**Internet access for code the assistant runs** sets how far code in the assistant's
sandbox can reach.

| Option | What it allows |
|---|---|
| **All public websites and services** | Code connects directly to any public website, so data from your projects can reach those websites. Private networks stay blocked. |
| **Only selected websites and services** | Code reaches only scientific databases and Python packages, through Biocompile. |
| **Approved destinations only** | Code reaches only scientific databases and Python packages, through Biocompile. |

The tools listed under **Tools and integrations** work with every option.

## Review and activate a change

1. Open **Organization → Security**.
2. Edit the rules. Result: the page shows **Unsaved changes** while your edits are a
   draft.
3. Enter a reason under **Reason for the change**. It is required.
4. Choose **Preview what changes**. Result: the preview shows how many resources are
   allowed and blocked, what is newly blocked, and which pipelines, assistant tools and
   skill helpers the change blocks.
5. Choose **Apply version** with the next version number.

A selected resource that becomes forbidden stays visible and is not silently replaced.

Choose **Show recent events** to see the latest security checks, with the outcome, what
was checked, where data was sent and why. Only where data went is recorded, never paper
content or full links.

## Personal preferences

Open **Settings → Privacy** to add stricter limits for yourself. Personal limits can only
remove access. They never override an organization denial.

Under **Data location**, the switch **Keep my data and AI processing in the EU** keeps AI
models and external services in the EU. Your files and account data are always stored in
the EU. Anything that cannot confirm an EU location is switched off, including models that
run outside the EU or on global endpoints. Code the assistant runs can still reach the
internet. Limit that under **Stricter limits**.

Under **Stricter limits**:

- **Use stricter limits** turns the limits below on.
- **Only tools and models Biocompile has checked** switches off tools and providers that an
  organization added itself or that have not been reviewed yet.
- **Where AI processing may happen** takes region codes separated by commas. Leave it empty
  for no limit.
- **Internet access for code the assistant runs** sets the most that code may reach. Your
  organization's setting can be stricter.
- **Clear all limits** resets the form.

## When a model is blocked

If a chat uses a model that your rules do not allow, a notice above the message box names
the model. When your own privacy settings are the cause, the notice reads "which your
privacy settings do not allow" and links to **Review your privacy settings**. When an
organization rule is the cause, admins get a link to the policy and other members are told
to ask an administrator.

## Limitations

| What is limited | Limit |
|---|---|
| **Show recent events** | The latest 100 security checks, refreshed every 30 seconds while the list is open. |

Policies restrict access; they cannot grant access that the organization or the platform
denies.

## Common questions

### Is my research data used to train AI models?

No. Biocompile does not use your queries or data to train, fine-tune or otherwise develop AI
models. Your inputs go to AI model providers only to generate responses for you, under the
providers' business terms, which exclude training on data submitted through their
interfaces.

### Where is my data stored and processed?

Your files and account data are always stored in the EU. Uploaded files are encrypted
before they are stored, and the storage is encrypted again at rest. AI models and outside services
may process data elsewhere unless your organization keeps AI processing in the EU, or you
switch on **Keep my data and AI processing in the EU** for yourself. Then anything that
cannot confirm an EU location is switched off. With **All public websites and services**,
code the assistant runs can send data to websites outside the EU.

### Can members loosen the organization's rules?

No. Personal limits under **Settings → Privacy** can only remove access, and never override
an organization denial.

## Related

- [Why AI models decline biology questions, and what to do](https://www.biocompile.com/docs/model-declines.md)
- [AI research assistant: ask your files and the literature](https://www.biocompile.com/docs/ai-research-assistant.md)

## Get access to Biocompile

Biocompile is used in the browser at https://app.biocompile.com. It is free to start and no payment method is required: sign up at https://app.biocompile.com/signup?mc_cta=docs-md&mc_path=/docs/organization-security.md. If your team already uses Biocompile, ask an organization admin to invite you. Research teams that want hands-on setup can apply for the founder-led pilot at https://www.biocompile.com/pilot/. Questions: https://www.biocompile.com/contact/.