Organization security: AI models, tools and EU processing

Biocompile’s organization security policy decides which model deployments, tools, pipelines and outside services people in an organization may use, and where their data may be processed. Organization owners and admins set it under Organization → Security, and each member can add stricter limits for themselves. Access to a resource and access to its destination are evaluated together against the current rules.

The summary at the top of Organization → Security shows the current rules and their version, how many research tools are on, and the setting for Internet access for code.

Choose a starting point

Open Organization → Security and find Starting point. Each option fills in the choices below it; they are not special modes, so you can change any choice afterwards.

Starting point	What it fills in
Recommended	Allows the outside services Biocompile has reviewed, wherever they process data.
EU only	Allows only the reviewed services that process data in the EU, and sets Where data may be processed to `eu`.
No outside services	Allows no outside services.

Every starting point sets Internet access for code the assistant runs to Only selected websites and services and leaves services Biocompile has not reviewed off.

To keep processing in the EU without changing anything else, switch on Keep AI processing in the EU, or enter region codes such as eu under Where data may be processed. A service is allowed only if every place it may process data is on the list. Models and services that cannot confirm an allowed location are blocked, and background tasks switch to EU-hosted models automatically.

Two more switches sit beside it:

Allow providers added in this workspace lets connections your organization set up, such as your own model endpoints, be used. Each one must also be allowed under Providers and switched on under Tools and integrations.
Allow services Biocompile hasn’t reviewed yet is off by default. Turn it on only if you need a service that has not been reviewed.

Example: keep AI processing in the EU

A team whose contracts require EU processing applies the policy once for everyone:

Choose EU only under Starting point. Result: Keep AI processing in the EU is on, and the page shows Unsaved changes.
Enter a reason under Reason for the change, such as “Customer contracts require EU processing”.
Choose Preview what changes. Result: the preview lists the resources that are newly blocked, such as models that run outside the EU.
Choose Apply version. Result: models and services that cannot confirm an EU location are blocked for everyone in the organization.

Choose what is allowed

The page lists what the rules cover, in this order:

Background models are the models Biocompile uses behind the scenes for titles, summaries and choosing a model. You can choose a model for each task under Your choice; if the rules do not allow it, the default is used. A task with no allowed model is skipped.
Providers are outside services that may receive your research data. Use Add your own provider to describe an address you use. It is shown as added in this workspace, not as reviewed by Biocompile.
Tools and integrations lists each integration with its models, tools, pipelines and research features. Open one to switch items on or off. Some recommended items are on by default, and your own choice always wins.
Optional Biocompile services are services Biocompile runs for you that you do not have to use. Turning one off stops it for everyone in the organization.

Allowing a provider is not enough on its own: the tools that use it must also be switched on.

Internet access for code

Internet access for code the assistant runs sets how far code in the assistant’s sandbox can reach.

Option	What it allows
All public websites and services	Code connects directly to any public website, so data from your projects can reach those websites. Private networks stay blocked.
Only selected websites and services	Code reaches only scientific databases and Python packages, through Biocompile.
Approved destinations only	Code reaches only scientific databases and Python packages, through Biocompile.

The tools listed under Tools and integrations work with every option.

Review and activate a change

Open Organization → Security.
Edit the rules. Result: the page shows Unsaved changes while your edits are a draft.
Enter a reason under Reason for the change. It is required.
Choose Preview what changes. Result: the preview shows how many resources are allowed and blocked, what is newly blocked, and which pipelines, assistant tools and skill helpers the change blocks.
Choose Apply version with the next version number.

A selected resource that becomes forbidden stays visible and is not silently replaced.

Choose Show recent events to see the latest security checks, with the outcome, what was checked, where data was sent and why. Only where data went is recorded, never paper content or full links.

Personal preferences

Open Settings → Privacy to add stricter limits for yourself. Personal limits can only remove access. They never override an organization denial.

Under Data location, the switch Keep my data and AI processing in the EU keeps AI models and external services in the EU. Your files and account data are always stored in the EU. Anything that cannot confirm an EU location is switched off, including models that run outside the EU or on global endpoints. Code the assistant runs can still reach the internet. Limit that under Stricter limits.

Under Stricter limits:

Use stricter limits turns the limits below on.
Only tools and models Biocompile has checked switches off tools and providers that an organization added itself or that have not been reviewed yet.
Where AI processing may happen takes region codes separated by commas. Leave it empty for no limit.
Internet access for code the assistant runs sets the most that code may reach. Your organization’s setting can be stricter.
Clear all limits resets the form.

When a model is blocked

If a chat uses a model that your rules do not allow, a notice above the message box names the model. When your own privacy settings are the cause, the notice reads “which your privacy settings do not allow” and links to Review your privacy settings. When an organization rule is the cause, admins get a link to the policy and other members are told to ask an administrator.

Limitations

What is limited	Limit
Show recent events	The latest 100 security checks, refreshed every 30 seconds while the list is open.

Policies restrict access; they cannot grant access that the organization or the platform denies.

Common questions

Is my research data used to train AI models?

No. Biocompile does not use your queries or data to train, fine-tune or otherwise develop AI models. Your inputs go to AI model providers only to generate responses for you, under the providers’ business terms, which exclude training on data submitted through their interfaces.

Where is my data stored and processed?

Your files and account data are always stored in the EU. Uploaded files are encrypted before they are stored, and the storage is encrypted again at rest. AI models and outside services may process data elsewhere unless your organization keeps AI processing in the EU, or you switch on Keep my data and AI processing in the EU for yourself. Then anything that cannot confirm an EU location is switched off. With All public websites and services, code the assistant runs can send data to websites outside the EU.

Can members loosen the organization’s rules?

No. Personal limits under Settings → Privacy can only remove access, and never override an organization denial.