Security
Most AI security is a promise about filtering. SweetHive's is a property of the data model: content that was never visible to you can never reach your AI, because scope is decided at write time, not query time.
There is no separate filter to misconfigure. What a person (or their agent) can retrieve is exactly what their groups can see, from their level of the context tree down. Guarantees that follow from the model, not from policy:
Every message, file and note enters a context addressed to groups. Visibility is set when content is created, never cleaned up afterwards and never inferred at query time.
Every AI answer is traceable to the exact items it was allowed to read. You can show, for any response, why each source was in scope.
Each agent lives in the scope its owner chooses and sees only that scope, within what its owner can see. Nothing crosses the tree without an explicit share. Attachments follow the same rule: an agent opens a file only if it is attached to a message the agent can see, through a link that expires after 10 minutes.
Scope isn't only a software boundary. Each member's agent runs where your organization decides: on the member's own computer with the SweetHive Agents Node, or on the organization's own hardware with the SweetHive Agents Server. Both run local models, so prompts and scoped content are processed inside your perimeter, and SweetHive hands each agent only its scope, re-checked against its owner's live visibility on every request. On the Agents Node a member can instead use their own Claude Code login; the model then runs at Anthropic under that member's account.
The free desktop app for macOS (Apple Silicon and Intel) and Windows runs its owner's agents with local models through the bundled Ollama runtime. It fetches content only within each agent's scope.
On Organization plans, one IT-managed server hosts the agents of every member: Docker on Linux, or the desktop edition on a Mac or a Windows machine. Each member's data is encrypted in its own tenant, and the console shows operations, never content.
An organization admin can turn on “Agents only on the company servers”. Members' agents that read the organization's hives must then run on its Agents Server, and agents on personal computers stop seeing those hives.
The blocker for AI in museums, schools and regulated businesses is always the same question: where does the data go? SweetHive's answer is structural, which is why it can be deployed where assistants bolted onto flat channels cannot.
SweetHive runs on AWS in the eu-west-1 region (Ireland). Data at rest lives in the EU, with automated backups and point-in-time recovery.
Traffic is encrypted in transit and data is encrypted at rest. Payments run on Stripe; card data never touches our servers.
With SweetHive Agents Node and Agents Server, AI models can run on your own hardware: prompts and data stay inside your perimeter during inference.
Account data and content are kept for as long as the account exists. If you delete your account, personal data is deleted or anonymized within technical backup cycles.
Access, rectification, erasure and portability are described in the privacy policy. Data protection officer: dpo@sweethive.com.
Every agent answer is attributable to the items it was allowed to read, publishing always requires explicit human confirmation, and AI output is always labeled.
Found a security issue, or need details these pages don't cover? Write to us and we'll route it to the right person.
One question, three personas, three correctly-scoped answers from the same hive, each traceable to exactly what it was allowed to read.
Get a demo