AI and data protection. Without leaving your network.
The question that follows “what can AI do” is almost always “where does our data go”. Here is the answer: what happens to data when an AI system works across internal systems, how that is set up against GDPR and Serbian data protection law, and what stays under your control.
Book a call (30 min) →Data stays in the systems it is already in.
The usual way to let AI into a company is to copy the data somewhere else first — into a new database, onto a new platform, with a new vendor. That single step creates a fresh copy of your contracts, price lists and tickets, on infrastructure you do not control.
Integral works the other way round: it searches your data where it already lives. It does not copy it, does not aggregate it, and does not hold your business data on MeteorIT infrastructure.
For systems that cannot or must not be exposed to the internet, the connection is made by an agent on your premises. In that case data never leaves your network — not for indexing, and not for processing.
The biggest risk is not an attack from outside.
With internal AI systems the damage usually does not come from a break-in. It comes from the assistant answering correctly to the wrong person — a salary, a margin, a contract term — because someone retained access to a source that was not theirs. Technically, the system worked as designed.
So the question of who may see what is settled before go-live, not after the first incident. How access control in Integral is structured — by role, by user and by department — is set out on the platform page.
The other half is provability. An answer without sources cannot be checked, so it cannot be audited; an automation that runs without confirmation leaves no moment at which a person could have stopped it. Both are configurable, and both are a decision you make rather than a default of the tool.
GDPR and Serbian law: the frame we work in.
MeteorIT d.o.o. Beograd processes personal data in accordance with the EU General Data Protection Regulation (GDPR) and the Serbian Law on Personal Data Protection (Sl. glasnik RS 87/2018).
In practice that means a written legal basis for each processing activity — legitimate interest, consent, or performance of a contract — and data subject rights to access, rectification, erasure, objection, restriction of processing and portability. The supervisory authority in Serbia is the Commissioner for Information of Public Importance and Personal Data Protection, at poverenik.rs.
This page describes how MeteorIT works and is not legal advice. Whether your processing is compliant is assessed against your processes and your legal bases, not on somebody else’s page.
Incidents, the 72-hour clock, and disclosure.
In the event of a personal data breach that poses a risk to the rights and freedoms of individuals, the relevant supervisory authority is notified within 72 hours, in accordance with GDPR and the Serbian ZZPL. Where required by law, affected individuals are notified without undue delay.
All traffic between the browser and meteorit.rs is encrypted with TLS; unencrypted HTTP connections are not accepted. Access to personal data collected through the site is restricted to authorised staff on a strict need-to-know basis.
Security vulnerabilities can be reported to ai@meteorit.rs, and we ask that they reach us before public disclosure, with reasonable time to investigate and remediate.
Three ways to deliver, three levels of data exposure.
Where the system runs after handover is not a technical detail — it is the decision that determines how much of your data leaves your network at all. So it is made deliberately, rather than falling out of a choice of tool.
Through the tools you already use
Your data passes under the terms you have already accepted with that provider. No new point of exposure, but no new control either — the boundary is whatever that contract allows.
Integral in our cloud
What sits with us is credentials and configuration, not your content — that is still read from the source systems. Exposure comes down to the connection, not a copy.
Integral on your servers
Nothing leaves your network — not content, not credentials, not the queries to the model. The only setup where the answer to the data-residency question is “nothing leaves at all”.
The choice of model stays yours
This matters for compliance: when a rule or a risk assessment changes, you change the model, not the whole system. There is no technical reason for one provider to hold you locked in.
Frequently asked.
- Does our business data go onto MeteorIT infrastructure?
- No. It is read from the source systems, with no copy held by us. In an on-premise setup even the connection stays inside, so the answer to “where is our data” is the same before and after AI is introduced — with you.
- Is the AI assistant GDPR compliant?
- No tool delivers compliance on its own — it depends on what data you process, on what legal basis, and who can access it. What the implementation does affect is that processing is minimised and controlled. MeteorIT operates in accordance with GDPR and the Serbian ZZPL (Sl. glasnik RS 87/2018), but the assessment of your own processing is made on your side, against your processes.
- Can we use AI without data ever leaving our network?
- Yes. There is a setup in which nothing leaves — neither content nor the queries to the model. It is meant for environments where data residency is not negotiable; the technical description is on the Integral page.
- Who in our company sees which data?
- As much as you grant, by role, by user and by department, down to the individual data source. The practical question to answer before go-live is who may see salaries, margins and contract terms, because the system will not assume those boundaries for you.
- Who do we contact if we suspect a data breach?
- The supervisory authority in Serbia is the Commissioner for Information of Public Importance and Personal Data Protection, at poverenik.rs. Where a breach poses a risk to the rights and freedoms of individuals, the authority is notified within 72 hours, and affected individuals without undue delay where the law requires it.
- Is ChatGPT used for our internal data?
- You choose the model. Integral runs on Claude, GPT-4, Gemini or a local model on your own infrastructure, and does not tie you to one provider. If the work is delivered through tools you already pay for, the system is built on top of the subscription your company already holds.
Start here
The first question is not which model.
If AI is going to work across internal systems, what it may see and where it runs are settled first. On a thirty-minute call we go through your systems, your access rules and your data-residency requirements, and tell you which of the three delivery models fits — and whether you need a platform at all.
Book a call (30 min) →or write to ai@meteorit.rs