Isolation is enforced in the database itself, not in application code that could be worked around. Every request runs inside the firm's own context; a request made without it returns no rows. The system fails closed, never open.

The container is resolved from the firm's identity on every access. This is a second layer, independent of the database isolation — a gap in one would not open the other.

In testing, one firm retrieved none of another firm's documents, and an attempt to write into another firm's space was refused. The database account the application uses cannot bypass these boundaries.

Sign-in runs through Microsoft Entra ID. Personal Microsoft accounts are rejected in code.

Verification happens server-side. Requests without a valid session are refused before reaching any data.

The application's database role is least-privilege and cannot bypass the firm-isolation rules.

This is an operating commitment held by the team, not a technical restriction.

All connections use TLS. The application-to-database link requires encryption on every connection.

Provided by the Azure platform: AES-256, platform-managed keys.

Storage, database, and application run in Azure's Sweden Central region. AI runs on deployments bound to the EU data zone.

Access to storage, database, and AI services uses Azure managed identity, with automatic rotation. There is no stored key or connection string to leak.

The organisation is applied by the server on every query. The model does not choose whose data to read.

Answers are grounded in the retrieved passages. Where the documents don't contain the answer, Signio is built to say so rather than fill the gap.

Signio reads the open message when you add it, and never as you scroll your inbox. Its text is used to produce that one answer and is discarded when the request ends; it is never indexed, never searchable, and never becomes part of your Knowledge unless you save it as a document yourself. Two things do persist, because they are part of the conversation you keep: the subject line becomes the conversation's title, and any part of the email Signio quotes in its answer is stored with that answer.

Signio reads by firm, not by person. When your question names a counterparty, it reads the messages to and from that firm's email domain. That means messages with anyone at that firm, not only the person you named, and only for that answer. It never reads messages with anyone else. To work out which firm a name refers to, Signio can ask Microsoft which email domains that name sends from. Microsoft searches your mailbox and returns a list of domains — never messages, subjects or addresses.

Nothing in Deleted Items, Drafts, Junk, Clutter or conversation history is ever read or used in an answer.

The messages Signio does read produce that one answer and are discarded when the request ends. They are never indexed or searchable, and they never become part of your Knowledge.

What persists is what the answer carries. Any part of a message Signio quotes is stored with that answer. The conversation also records which firms were read, by their email domain, over what period, and how many messages — never their content, and never the individual addresses. One exception: if Signio asks you whether an address in your mailbox is yours, that address is kept with the conversation.

Signio does not fine-tune on customer data. Our AI provider's terms commit that prompts and completions are not used to train foundation models. The "never another firm's questions" half is enforced by the isolation above.

Signio keeps an audit record of key events, tied to your firm.

The file and its database records leave the live system at once — they stop being searchable, citable or retrievable the moment you delete them. A recoverable copy is retained for up to seven days, encrypted and in the EU — the file in its storage account, its records in point-in-time backup — and then permanently expires.