Data, permissions and AI

Where business records live

ExaDash is a desktop application built around local SQLite business storage. Optional LAN multi-user connections, external services and configured AI providers involve network data transfers when enabled. Local database storage does not mean every optional service runs on your device.

Who can access information

The workspace enforces named user accounts together with role and page permissions, with separate access checks for financial and receivable views. AI context retrieval respects the active user session and the permission boundaries of its underlying records.

During evaluation and onboarding, we review the exact roles, enabled modules and permitted data sources required for your installation.

Which model runs the AI?

The native provider integration supports Google Gemini, and alternative model providers can be configured upon request. Model selection and connection mode depend on your installation settings.

ExaDash does not claim that AI models execute locally on your workstation. Data retention, model training policies and processing locations depend on the external AI provider and commercial plan you select.

What data is sent to a provider?

When an AI feature is enabled and invoked, it sends the system instructions, user prompt and permitted retrieved context required to answer the query. Missing or unsupported records are disclosed rather than fabricated.

Provider API credentials are stored through the operating system’s native credential management, separate from company database backups.

Can the AI change records?

AI-generated actions and drafts are presented strictly as proposals for human review. Committing any change to business records requires explicit confirmation by an authorised user.

Before deployment

Before enabling external connections in production, review your installation architecture, role permissions, backup procedures and third-party provider contracts against your organisation’s governance requirements. Our team helps you select the configuration and workflow boundaries best suited to your operational needs, while final regulatory and GDPR compliance verification remains with your organisation and its chosen service providers, whose terms and policies are governed independently by each provider.