AI Safety

Last updated 2026-09-13

How the Boreon™ Support assistant stays grounded, read-only, Swiss-sovereign, and under human supervision.

Boreon™ Support includes an AI assistant. These are the commitments that govern how it behaves — the same principles the platform is built on, stated plainly.

Grounded, or it declines

The assistant answers a factual question about TabTotal only when it can support the answer from indexed TabTotal documentation or a read of your account, and it shows you the sources it used. When it cannot answer with confidence, it does not guess. “I don't know” is a first-class outcome: the assistant says so honestly and opens a case that reaches a human. Working through a problem with you — asking what happened, which tool, what the error said — is dialogue, not a factual claim, and is encouraged; inventing product behaviour is not.

Read-only, always

The assistant has no ability to write to, or change, your Tableau or TabTotal state. Any read of your connected Tableau site is strictly read-only and scoped to your licence. The only action that changes anything is a case you explicitly open, which carries your conversation to the team — the assistant cannot take that step for you without your click.

A human is in the loop

When staff work a case, any AI-drafted reply is logged as a suggestion and is never sent to you unreviewed. A person reads, edits, and owns every reply and every resolution. No case is closed without a real answer.

Sovereign inference by default

By default, the AI that powers the assistant runs on Infomaniak AI Services in Geneva, Switzerland, using open models — so your prompts stay within Switzerland. A Boreon Super Admin may route a specific task to Anthropic Claude as an explicit, audited option; only then, and only for that task, do those prompts leave Switzerland. The choice is deliberate, logged, and off by default. No model ever runs on your device or inside the application itself.

No training on your data

Boreon does not use your support conversations, your cases, or your account data to train AI models. Your data is used to answer your question and to run your case — not to build a model.

No autonomous actions

The assistant does not act on your account or systems on its own initiative. It answers, it asks diagnostic questions, and it can prepare a case for you to open. It does not schedule, purchase, delete, or change anything by itself.

Audit trail

Significant actions on the platform — including AI events such as a drafted suggestion and the routing of a task to a non-default provider — are recorded in an audit trail, so what happened can be reviewed later.

Honest about the limits

The assistant is helpful but not infallible, and we do not claim the platform is unhackable. What we do run are concrete controls: grounding with visible sources, read-only access, per-licence scoping, encrypted secrets, human review of case replies, rate limits, and a full audit trail. If an answer looks wrong, open a case or write to support@boreon.com and a human will look.