CloosphereAll Your AI, Safely in One Place. Your data is stored in your environment, and changes are logged with who made them
Cloosphere isn't SaaS.
It's deployed into your own cloud account or internal infrastructure, and conversations, documents, and logs are stored in that environment's own database and storage.
Nothing is sent to servers run by Cloocus.
Deployment methods
| Item | Your cloud | On-premises Coming soon | Air-gapped network Pre-deployment readiness check |
|---|---|---|---|
| Where it runs | Your own Azure · Google Cloud · AWS account | Your own data center | An internal network with no outbound internet |
| LLM | Your account's Azure OpenAI, Vertex AI, etc. | Your account or an internal model | An internally hosted model (Ollama) or an approved private endpoint |
| License check | A signed license file, verified locally in the deployment | Same | Same — no communication with a license server |
| Operations | Cloocus as an MSP, or your own team | Your own team (Cloocus technical support) | Your own team (Cloocus technical support) |
- For air-gapped deployments, a pre-deployment readiness check disables outbound features (web search, external tools, external extraction APIs) and stages any required files internally ahead of time.
Where your data lives, and where it goes
| Data | Stored in | When it leaves |
|---|---|---|
| Conversations · attachments | Your environment's DB · storage | Sent to the LLM account you connected, to generate answers |
| Knowledge Base documents | Your environment's storage · vector DB | Sent to the embedding model and extraction engine you connected, for embedding and extraction |
| Internal DB query results | Inside your environment — cached execution-result files, traces (result preview), and any tables/charts used in an answer | Sent to the LLM account you connected, to generate answers |
| Audit logs · traces · usage | Your environment's DB | None |
| Secrets (DB passwords · API keys) | Your environment's DB, stored encrypted | None |
| Web search queries | — | Sent to the search provider an admin chose, when web search is on |
- You choose the path to the LLM. Cloosphere calls the endpoint in your own account directly, with no Cloocus proxy in between.
- Personal information is filtered before it reaches the model. Guardrails block, delete, or mask personal information at the input stage.
- The only data sent to Cloocus is a support request you submit yourself. Submitting a request inside the product sends its title, type, content, and your name and email to Cloocus's support server — and only when a support connection was configured at deployment. There is no telemetry, license-server, or update-check traffic.
- Each LLM provider's data-handling policy: Azure OpenAI · Vertex AI · OpenAI
Who can do what
Microsoft Entra ID · Google · GitHub · OIDC · LDAP. Can also accept ID tokens from a trusted external IdP directly.
Organization → Department → Group. Automatic org-chart sync from Entra ID or Google Workspace.
Access requires both function-level permission (menus/features) and resource-level permission (on each individual agent, Knowledge Base, DB). Permissions have 4 levels: None · Access · Read · Write.
Only approved models are exposed, with per-user/group/organization access and a daily token limit.
A person approves data-changing SQL, write-type external tool calls, and email sends right before they run.
Even when someone else runs a shared task, it always executes with the creator's permissions — access never escalates.
Only the conversation owner can do this.
What's logged
Records creation, modification, and deletion across 19 resource types, with before/after values, IP, and browser information — including user role changes and logins.
Members can check changes to 6 categories — Knowledge Base · Agents · Databases · Guardrails · Glossary · Skills — themselves.
Detection type, how it was handled, time, and user, with a jump to the corresponding trace.
The full path of a single answer — LLM calls, retrieval, tools, and SQL execution.
Execution, approval, and rejection of write queries.
Email sends and document-generation history.
Key wrapping, unwrapping, and rotation are recorded in a tamper-evident hash chain, with reasons captured and CSV export.
A retention period is set per record type, with automatic cleanup.
Encryption · secrets management
Azure Key Vault envelope encryption (AES-256-GCM data keys + RSA-OAEP-256 key wrapping), keys separated by data classification, automatic key rotation, hash-chain audit logging
- Secrets such as DB connection info, tool connection keys, and user API keys are envelope-encrypted with an Azure Key Vault key. Data uses AES-256-GCM, the data key is wrapped with RSA-OAEP-256, and the master key never leaves the vault.
- Personal-information and financial classifications use separate keys.
- Automatic re-encryption on key rotation, a pre-flight health check, and atomic storage so a bad key reference can never overwrite a working configuration.
- Secret values are masked wherever they appear on screen.
- Transport encryption (HTTPS) and storage encryption follow the settings of your deployment environment (cloud/infrastructure).
Encryption (KMS) is included in the Enterprise tier. → Pricing · licensing
AI usage controls
- Detects 12 PII types (including 6 Korea-specific types), with 5 handling strategies, banned words, regex, and an LLM judge.
- Global, organization-level, and per-agent policies, plus inspection of uploaded files.
- Calls from coding agents (Claude Code · Codex · Gemini CLI · Cursor) fall under the same guardrails and logging.
- For MCP and OpenAPI tools, an admin chooses which tools users can see, and write tools never run without approval.
Learn more → Governance
Updates and vulnerability response
Monthly. Changes are published in the release notes.
Emergency security patches are released outside the regular release schedule. Your account manager will advise on the delivery method and target turnaround time based on the severity of the vulnerability.
Open-source dependency versions and security advisories are reviewed monthly.
Report it to GEN_AI@cloocus.com. We respond within 1 business day of receiving it.
Ask us what your security review needs
If you need more on the deployment structure, data flow, access control, or audit records, our team will answer your questions.