Security and data

Decide what each agent may see, do and keep.

Name: AksharAI
Brand: AksharAI
Price: 7500 INR

An agent that reads invoices or patient records needs firm limits. On AksharAI you choose where the platform runs, which data each agent may read, which actions need a person, and how long the record of each run is kept.

Talk to our team Deployment and governance

AksharAI / list

AksharAIRun log, invoice matching agentSearchAK

Run log, invoice matching agent

Time	Run	Sources read	Action	Status
10:42	INV-3385	PO-2212, GRN-875	Draft voucher	Review
10:39	INV-3381	PO-2208, GRN-871	Draft voucher	Approved
10:31	INV-3380	PO-2203	Hold, rate differs	Escalated
10:22	INV-3379	PO-2199, GRN-866	Draft voucher	Approved
10:15	Payroll read	Workspace policy	Refused	Blocked

Representative screen with sample data. Client screens stay private.

In short

Where does AksharAI run, and who can see our data?

You choose per application: hosted by Code Colonies, inside your own AWS, Azure or Google Cloud account, or on your own servers with open models when data must not leave the building. Each agent reads only the systems, folders and fields its task needs, actions that matter wait for a named person, and every run is logged.

Setups: Hosted, private cloud, on premise, white label
Access: Only what the task needs
Approvals: A named person, on what matters
Law: DPDP Act, 2023

Where it runs

Three setups, plus white label for partners

An internal FAQ copilot and a discharge summary agent have different needs. You can run them on different setups.

Blue fibre optic cables connected to switch equipment in a data centre

Setup
Hosted by us
The quickest start. Code Colonies runs the platform, applies updates and watches it. Suits agents that handle routine business data.
SuitsSupport on public order data, internal FAQs, sales briefs
Setup
Your private cloud
AksharAI runs inside your own AWS, Azure or Google Cloud account, under your network rules, keys and logging.
SuitsFinance, HR and customer data that must stay in your account
Setup
On premise
Installed on your own servers, with open models you host where data must not leave the building at all.
SuitsHospitals, legal teams, lenders and government work
Setup
White label
For partners who offer AI apps to their own clients under their brand, on any of the three setups above.
SuitsSoftware firms, consultancies and agencies

Guardrails

The limits every agent works within

Access and visibility

Workspaces separate teams. Each person sees and builds only what their role allows, and admins decide who may publish an app.

Data permissions

Each agent reads only the systems, folders and fields its task needs. A support agent can see order status without seeing payment details.

Prompt and tone control

Standing instructions set the agent's role, language, tone and the topics it must refuse. Changes are tested on past cases before release.

Action boundaries

For every action, such as sending a message, creating a ticket or preparing a voucher, you choose: allowed, needs approval, or blocked.

Logging and oversight

Every run records its inputs, the sources used, the output, the model, and who approved what. Reviewers can sample runs and mark mistakes.

Handover to people

Agents say when they do not know, and pass the case to a named person with the context.

Logging

What every run records

The log is how you investigate a mistake, answer an auditor and improve the rules. Retention is a setting you control.

What started the run: the email, message, file or schedule
Which knowledge sources and records the agent read
Each step's output, including tool calls and their results
Which model and which version of the instructions were used
Who approved, edited or rejected the result, and when
What was finally written or sent, and to which system

Models and your data

What the model provider sees

Each step sends the model only the text it needs. You choose the provider for each application.

You choose the model provider per application, and can use your own provider account.
Where a provider offers settings that stop your data being used for training, we use them, and tell you which apply.
For data that must not leave your environment, open models can run inside your private cloud or on premise.
Prompts, documents and logs stay in the deployment you chose; the model only sees what each step sends it.

DPDP Act, 2023

Personal data in prompts, logs and outputs

When an agent processes personal data of people in India, the Digital Personal Data Protection Act applies to that processing. These are the points we work through with you for each agent.

Purpose and notice
An agent that processes personal data needs a clear purpose, and the people concerned need notice of it. We help you write down what each agent processes and why.
Minimum data
Agents are given only the fields their task needs. Where a step does not need identifiers such as PAN or phone numbers, they are left out or masked before the model sees them.
Retention
Run logs and copies of documents are kept for the period you set, then deleted, so the log does not quietly become a second database of personal data.
Security safeguards
Access controls, separated workspaces, limited permissions and run logs support the reasonable security safeguards the Act asks for. Your deployment choice decides who runs them.
Requests and breaches
Logs help you answer access and erasure requests and investigate incidents. For the full set of DPDP duties, TrustOS, the group's compliance platform, can help.

This is practical guidance, written in October 2026. Your counsel decides how the law applies to your organisation. Official text: MeitY data protection framework. For the wider DPDP programme, see TrustOS.

Questions

What security and procurement teams ask

Tell us what your security review needs, and we will set out the evidence and controls we can provide.

Do you hold security certifications such as ISO 27001 or SOC 2?

Share your security questionnaire or procurement checklist with us. We will answer each point with the controls and documents that apply to your deployment, and advise whether a private cloud or on premise setup under your own controls suits you better.

Where is our data stored when you host it?

In the hosting region agreed for your workspace. If data must stay in India or inside your own account, choose private cloud or on premise, and we will confirm the setup in writing.

Does the model provider see our data?

The model sees the text each step sends it, nothing more. You choose the provider, and for sensitive work you can use an open model that runs inside your own environment.

Can an agent be tricked into doing something harmful?

Inputs such as emails and documents can contain instructions meant to mislead an agent. We separate instructions from data, limit each agent's tools, and require approval for actions that matter. No system is immune, so approvals and logs stay in place for every action that matters.

Who at Code Colonies can see our workspace?

On hosted setups, only named engineers supporting your account, and only when needed. On private cloud and on premise, access is whatever you grant.

Guide