The second question every owner asks about an AI tool, right after "what does it cost", is "where does my data go?"
It is a fair question and it usually gets a fuzzy answer. Something about encryption, something about certifications, and no actual description of what travels where. So here is the actual description for Rai, our AI analyst for retail businesses.
The two halves#
The brain lives on our infrastructure. It holds the agent loop, the prompts, the catalog of business metrics, the advice and forecasting logic, the metering, and the channel plumbing that pushes briefs out over WhatsApp. Everything genuinely valuable is here.
The connector is a small app installed on your own server, alongside the system you already run. It is deliberately, almost aggressively, unintelligent. It can do exactly four things: prove who it is, receive a plan describing what to fetch, run that plan locally against your own database, and send back the result.
It contains none of Rai's reasoning. You could read every line of it and learn nothing worth stealing - which is not an accident, it is the point.
What actually crosses the wire#
Your question
│
▼
[connector] ──► [Rai brain] decides WHAT to fetch (a query plan)
▲ and phrases the answer
│ │
└──── runs the plan locally ◄──┘
against your database,
returns aggregates only
Read that loop carefully, because the direction of travel is the whole story.
What goes up to the brain: your question, and a computed result like "revenue by item, last month" - a small table of totals.
What never goes up: the invoices those totals came from. Your customer list. Your supplier contracts. Individual transactions. Serial numbers. Any row of your actual business.
The brain decides what it wants to know. Your own server does the knowing.
Why this is more than a privacy policy#
Plenty of vendors promise not to look at your data. A promise is worth exactly as much as the company making it.
This design is structural. Your rows do not leave because there is no code path that sends them. That is a different kind of assurance from a paragraph in a contract - it is one you could verify by reading the connector we installed on your own machine.
And it is stable, because the same split protects us. If we shipped the full system to every client, our metric catalog and our agent design would be sitting on a hundred servers we do not control. Because the brain stays hosted, it cannot be copied, and our metering cannot be tampered with either. We are not being generous about your data; our interests and yours happen to point the same way, which is the only kind of guarantee that survives commercial pressure.
The best privacy guarantees are the ones the vendor also needs for themselves.
The seam that protects the future#
There is one more piece of this worth knowing about, because it explains why Rai will still make sense in three years.
Today, Rai reads from ERPNext, because that is what UpeoRetail runs on. But the agent itself never talks to ERPNext. There is a single thin module in between, and it is the only code in the entire system that knows what an ERPNext doctype is or how its tables are laid out. The agent asks for canonical business things
- "sales by item last month", "dead stock" - and that module translates.
Which means the day we add a spreadsheet source, or an accounting API for businesses that do not run an ERP, we are writing a new translator behind the same interface. The reasoning, the metric catalog, the advice logic, the briefs - none of it changes.
That is what a seam is for. It is a small amount of discipline paid now so that the obvious next step later is an addition rather than a rebuild.
What you are actually trusting#
Stripped of the architecture diagram, here is the honest summary.
You are trusting us to run the thinking well - to ask your database sensible questions and phrase the answers correctly. That is a real trust, and we earn it with the metric catalog and the regression tests behind it.
You are not trusting us with custody of your business records, because we never take custody of them. Those stay where they already are: on your server, under your control, behind your own permissions.
Those are two very different kinds of trust, and it is worth knowing which one any AI vendor is actually asking you for.
