You stop an AI showing sensitive information to the wrong colleagues by enforcing permissions at the point of retrieval, so the system only draws on sources the person asking is entitled to see. Kimia, a chemical intelligence platform, does this with role-based access control (RBAC), enterprise SSO, directory sync and a workspace fully isolated from every other customer.
Permissions belong in the retrieval layer
An assistant that indexes every document and applies no identity check at question time will answer anyone with anything it holds. The exposure happens at retrieval, before anyone decides to share, so a usage policy cannot fix it. Kimia enforces role-based access control (RBAC) with the principle of least privilege: the identity a colleague signs in with determines which sources their answers can draw on. You control who sees what.
In practice: a commercial rep asks for talking points on a polyurethane dispersion grade. Their answer draws on the technical data sheet and application guidance. The formulation record behind the grade is restricted to R&D roles, so it never enters the rep's answer.
Directory sync keeps access current when roles change
Most internal exposures are not attacks. They are permissions that outlived the role that justified them. A rep changes business units, a contractor's engagement ends, and yesterday's access follows them into today. Kimia provisions access through enterprise SSO and directory sync, so permissions come from your identity provider, not from a list somebody maintains by hand. When the directory changes, what the assistant will retrieve for that person changes with it.
In practice: a rep moves from the coatings business unit to adhesives. The role change lands in the company directory, directory sync picks it up, and queries that once drew on coatings customer records now stop at the boundary of the new role.
Data isolation separates your workspace from every other customer
Inside your organisation, the question is which colleagues see what. Between organisations, the question is whether your data can surface in someone else's answers. Every Kimia customer operates in a fully isolated workspace, with no shared learning between workspaces. Your proprietary product data, formulations and customer information never train models that serve anyone else. You can export your data at any time, and if you cancel, it is deleted on request.
In practice: a supplier loads proprietary formulation records for its REACH-registered adhesive grades. A competitor running Kimia in its own workspace can never retrieve them, and nothing learned from those records improves any answer outside the supplier's own organisation.
Source attribution makes an exposure visible instead of silent
Access control decides what an answer may draw on. Attribution shows what it actually drew on. Every Kimia response is grounded in your knowledge base with source attribution, so any answer can be traced back to the document or data point behind it. A misfiled document is therefore no longer invisible: if a confidential file sits where the wrong roles can reach it, the citation shows it the first time it surfaces.
In practice: an answer to a rep quotes an unfamiliar cost figure. The attribution points to a margin analysis uploaded into a shared product folder. The document is moved behind the correct role the same day, rather than circulating unnoticed in follow-up emails.
Compliance you can verify, and where the claims stop
Kimia is SOC 2 Type II and GDPR compliant, with enterprise authentication and encryption as standard, and it runs on SOC 2 and GDPR-certified infrastructure partners including AWS. Multi-factor authentication (MFA) is enforced across critical internal systems, and independent third parties perform annual penetration testing. The claims stop there. For a full security review, Kimia's trust portal holds the compliance reports, audit documentation and data privacy policies, so your IT team verifies rather than taking the answer on trust.
In practice: an IT reviewer at a specialty chemicals distributor is asked to sign off before a deployment that touches EU customer data. They pull the SOC 2 Type II report and GDPR documentation from the trust portal and run the review against the evidence.
What changes
Scoped answers: every colleague's answers draw only on sources their role permits
Access that expires: directory sync withdraws permissions the day a role changes
Isolated workspaces: nothing your organisation loads surfaces for any other customer
A visible trail: source attribution shows which document produced each answer
An assistant is safe to roll out across a commercial team when access follows role, workspaces stay isolated, and every answer traces to its source. Kimia is built to that standard.
FAQ
Does Kimia use your data to train its models?
No. Your proprietary product data, formulations and customer information are used solely to improve your own organisation's experience. Kimia's chemical intelligence is built on top of public chemical data, and learnings from your workspace never leak to other customers or external systems.
How does Kimia control which colleagues see confidential information?
Kimia controls this with role-based access control (RBAC), provisioned through enterprise SSO and directory sync. Access follows the principle of least privilege: what a colleague can retrieve is decided by the role they sign in with, and it updates when the directory does. You control who sees what.
Is Kimia SOC 2 compliant?
Yes. Kimia is SOC 2 Type II and GDPR compliant, with enterprise authentication and encryption as standard, and independent third parties perform annual penetration testing. Kimia's trust portal holds the compliance reports, audit documentation and data privacy policies for a full security review.
