Privacy & Security Model

Conduit's privacy model is built on a foundational principle: we record context, not conversations. Raw interactions are temporary. The knowledge patterns extracted from them are permanent but abstract -- no verbatim storage, no reconstructable transcripts.

Design Philosophy

Traditional enterprise communication tools store everything forever -- every message, every file, every reaction. This creates legal liability, privacy concerns, and an ever-growing data burden. Conduit takes the opposite approach:

• Conversations are temporary: They expire after a configurable period (default: 30 days)
• Context is permanent: Expertise patterns, collaboration metrics, and organizational knowledge persist abstractly
• Abstraction is the firewall: Raw conversations are never stored long-term; only derived patterns survive

This means Conduit delivers the benefits of organizational memory (knowing who knows what) without the risks of permanent surveillance (storing what everyone said).

Thread-Level Isolation

In Conduit's AI-Mediated Collaboration system, each participant operates in their own isolated conversation thread.

How Isolation Works

Thread A (Executive):     Only Executive + AI can see this thread
    |
    | (only refined intent passes down)
    v
Thread B (Manager):       Only Manager + AI can see this thread
    |
    | (only refined intent passes down)
    v
Thread C (Expert):        Only Expert + AI can see this thread

Isolation Guarantees

| Guarantee | Description | | -------------------------- | ----------------------------------------------------------------------------- | | No upstream visibility | Subordinates never see the threads above them | | Intent-only transfer | Only the AI-refined question passes between levels | | No cross-thread access | Participants cannot access threads they are not part of | | Audit-only exceptions | Only compliance officers with explicit permissions can review thread metadata |

What Flows Between Threads

| Flows Down | Does NOT Flow Down | | ------------------------ | ------------------------------- | | Refined question intent | Original phrasing from upstream | | Relevant domain context | Management commentary | | Urgency/priority signals | Identity of the original asker | | Factual constraints | Political context or opinions |

Conversation Expiration

All conversations in Conduit have a finite lifetime.

Default Configuration

| Parameter | Value | Configurable | | -------------------------- | ------------------------- | ------------------------------- | | Time-to-live (TTL) | 30 days | Yes (per-org, per-conversation) | | TTL reset on activity | Enabled | Yes | | Pre-expiration warning | 7 days before | Yes | | Context extraction | Automatic, pre-expiration | Always on |

What Happens at Expiration

1. Context extraction runs: The Context Engine extracts abstract patterns -- expertise signals, collaboration metrics, domain coverage
2. Raw messages deleted: The actual conversation text is permanently removed
3. Intent lineage preserved: The chain of refined intents is kept (anonymized) for audit purposes
4. Metadata retained: Timestamps, routing paths, and resolution metrics are kept for analytics

Post-Expiration State

{
  "conversationId": "conv-abc123",
  "status": "expired",
  "expiredAt": "2026-03-12T00:00:00Z",
  "rawMessagesRetained": false,
  "contextExtracted": true,
  "extractedPatterns": {
    "expertiseDomains": ["manufacturing", "maintenance"],
    "resolutionTime": "1h 30m",
    "routingDepth": 4,
    "participantCount": 4
  },
  "intentLineage": "preserved (anonymized)",
  "auditTrail": "retained"
}

Context Abstraction

Context abstraction is the process of transforming raw conversation data into abstract organizational knowledge. This is what makes it possible to "record context, not conversations."

Abstraction Process

Raw Conversation                    Abstracted Context
----------------                    ------------------

"The bearing failed because        -> Domain: maintenance
 we missed the PM cycle.              Expertise signal: preventive maintenance
 I replaced the bearing and           Problem type: equipment failure
 updated the schedule to              Resolution: corrective + preventive
 weekly inspections."                  Quality: detailed, actionable answer
                                       Expertise level evidence: HIGH

What Gets Abstracted

| Raw Data | Abstracted Form | | --------------------- | --------------------------------------- | | Specific answers | Domain expertise signal + quality score | | Question/answer pairs | Problem-type classification | | Conversation flow | Collaboration pattern metrics | | Routing path | Organizational knowledge flow map | | Response times | Responsiveness metrics per domain |

What Is Never Stored Long-Term

• Verbatim message text
• Quoted content from participants
• File attachments shared in conversations
• Specific names in conversation context (anonymized in lineage)

Data Architecture

Conduit uses a three-database architecture, each optimized for its specific role in the privacy model.

Neo4j -- Graph Relationships

The knowledge graph stores organizational relationships and expertise connections.

| Component | Count | Description | | ---------------------- | --------------- | -------------------------------------------------------------- | | Node types | 7 | User, Team, Department, Domain, Skill, Conversation, Query | | Relationship types | 14 | HAS_EXPERTISE, BELONGS_TO, COLLABORATES_WITH, REPORTS_TO, etc. | | Query patterns | Graph traversal | "Find experts in domain X within team Y" |

PostgreSQL -- Relational Data

Structured data with row-level security for multi-tenant isolation.

| Component | Count | Description | | ---------------------- | ------- | ------------------------------------------------------------- | | Tables | 19 | Users, teams, conversations, audit logs, configurations, etc. | | Row-Level Security | Enabled | Each tenant can only access their own data | | Encryption | AES-256 | Data encrypted at rest |

pgvector -- Semantic Search

Vector embeddings for semantic similarity search across context.

| Component | Details | | ------------------------ | ------------------------------------------------------------- | | Embedding dimensions | 1536 | | Use cases | Expertise matching, query similarity, semantic tag resolution | | Index type | IVFFlat for approximate nearest neighbor |

Access Control

Role-Based Access Control (RBAC)

Conduit implements three primary roles:

| Role | Permissions | | ----------- | ------------------------------------------------------------------- | | User | Own threads, own context export, query NQE within scope | | Manager | Team-level analytics, routing oversight, team context views | | Admin | Full configuration, audit access, organizational context management |

Single Sign-On (SSO)

| Protocol | Support | | -------------------- | -------------------------------------------- | | SAML 2.0 | Full support for enterprise IdP integration | | OAuth 2.0 / OIDC | OpenID Connect for modern identity providers |

Authentication Tokens

| Parameter | Value | | ------------------ | -------------------- | | Algorithm | HS256 | | Token expiry | 15 minutes | | Refresh token | 7 days | | Token rotation | Automatic on refresh |

Data Sovereignty

Conduit is designed to be self-hosted because organizational context is intellectual property. Companies need full control over where this data lives and who can access it.

Deployment Options

| Option | Description | | ----------------- | --------------------------------------------- | | On-premises | Full deployment within your infrastructure | | Private cloud | Dedicated cloud instances (AWS, Azure, GCP) | | Air-gapped | Disconnected environments with Ollama for LLM |

Sovereignty Guarantees

• No data leaves your infrastructure (when self-hosted)
• LLM providers can be swapped for local models (Ollama)
• All context data is stored in databases you control
• No telemetry or usage data sent externally

Audit Trail

Every significant action in Conduit is logged for compliance.

What Is Audited

| Action | Logged Data | | --------------------------- | ----------------------------------------------------------- | | Context export | Who exported, what format, timestamp, approval chain | | Context import | Source, destination user, schema version, validation result | | Expert queries | Who queried, what domain, results returned | | Routing decisions | Who routed to whom, refined intent, timestamp | | Conversation expiration | Conversation ID, extraction results, deletion confirmation | | Access control changes | Role changes, permission grants, SSO events |

Audit Query Example

# Query audit log for context exports
curl https://conduit.example.com/api/audit/logs \
  -H "Authorization: Bearer <token>" \
  -d '{
    "action": "context.export",
    "dateRange": {
      "from": "2026-01-01T00:00:00Z",
      "to": "2026-02-10T23:59:59Z"
    }
  }'

Ownership Model

Conduit has a clear ownership model for all context types.

Individual Ownership

Your individual context belongs to you:

• You can export it at any time in JSON, GraphML, or CSV format
• You can take it with you when you leave an organization
• No approval needed for export of your own individual context
• Schema version v1.1 ensures cross-instance compatibility

Company Ownership

Relational and organizational context belongs to the company:

• Relational context (how people collaborate) is organizational IP
• Organizational context (team structures, expertise distribution) is company data
• Export of company-owned context requires admin approval
• Relational context naturally decays when participants separate

The Boundary

+----------------------------------+-----------------------------------+
|       INDIVIDUAL (Portable)      |        COMPANY (Retained)         |
+----------------------------------+-----------------------------------+
| Personal expertise scores        | Collaboration effectiveness       |
| Domain proficiency levels        | Communication patterns            |
| Problem-solving patterns         | Team expertise profiles           |
| Query history patterns           | Org chart and structures          |
| Skill demonstrations             | Knowledge flow maps               |
+----------------------------------+-----------------------------------+
| Ownership: The person            | Ownership: The organization       |
| Export: Self-service             | Export: Admin approval required    |
| On departure: Goes with you      | On departure: Retained + decayed  |
+----------------------------------+-----------------------------------+

Next Steps

• Context Engine -- Learn how context is built and scored
• AI-Mediated Collaboration -- See privacy isolation in action
• Architecture -- Understand the technical infrastructure
• Getting Started -- Set up Conduit in your environment