CVS is engineered for security teams that will not approve a black box. Multi-tenant RBAC, four deployment models up to full air-gap, and layered isolation give you execution sovereignty — not just a data-residency promise.
Access in CVS follows a strict hierarchy: Tenant → Instance → Workspace/Department → Role → User → Permission → Audit Event. Each tenant is isolated from every other, and instances partition knowledge within a tenant so a department only ever sees what it is entitled to.
Identity is handled through your existing SSO via SAML or OIDC, with RBAC at the core and optional ABAC policies for attribute-based rules. Every query and every piece of evidence access is written to a tamper-evident audit trail — the minimum-necessary standard enforced in software, not in policy documents.
CVS spans the full range from fastest start to maximum control: CVS Cloud, Dedicated Cloud, Self-Hosted, and Air-Gap. Cloud gets you live in under 48 hours with managed updates; dedicated cloud gives single-tenant isolation in your AWS, Azure, or GCP region with bring-your-own-key encryption.
Self-Hosted runs entirely inside your perimeter on Docker Compose or Kubernetes, with local LLMs served through Ollama or vLLM. Air-Gap goes further — zero external API calls, no telemetry, no phone-home, with updates delivered on physical media. Every tier supports the same generic compliance posture: SOC 2, GDPR, and HIPAA-aligned controls.
CVS isolates data at every layer of the request path: User/SSO authenticates the caller; the API gateway enforces policy; the tenant boundary and instance boundary partition knowledge; encrypted stores hold data at rest; and answer generation runs against a local or explicitly approved LLM backend. Every step lands in the audit log.
In self-hosted and air-gap modes the perimeter is absolute — data, models, indexes, answers, and logs all stay inside your environment, encrypted with AES-256 at rest and TLS 1.3 in transit. This is full execution sovereignty, the architecture behind generic SOC 2, GDPR, and HIPAA compliance rather than a marketing badge.
Not "data residency" marketing — full execution sovereignty. Data, models, indexes, answers, and audit logs all remain inside your perimeter. Zero external API calls in air-gap mode.
We will walk through the isolation architecture, deployment options, and audit model — and stand up an air-gapped proof of concept inside your perimeter.