Giving Staff a Company AI Assistant Without Sending Data to a Consumer Chatbot

The challenge

Staff were going to use AI whether or not the company provided it. The realistic choice was not between AI and no AI — it was between a sanctioned platform inside the company's own environment and an unmanaged sprawl of personal accounts on consumer services, with company information going wherever those services put it.

Where we came in

The instinct is to write a policy. A policy without a sanctioned alternative just moves the usage somewhere you cannot see it. We deployed an open-source chat platform into the company's own cloud tenant, behind the company's own sign-in, so that using it correctly is also the easiest thing to do.

What we did

• Deployed an open-source AI chat platform on Kubernetes inside the company's own Azure tenant
• Integrated multiple model providers behind one interface, using the company's own API accounts
• Implemented single sign-on against the existing corporate directory so access follows existing joiners and leavers
• Configured secure public access on a company-controlled address
• Handed over with the infrastructure documented rather than as a black box

Where it landed

• Staff have a sanctioned AI assistant running inside the company's own cloud environment
• Access is governed by the same directory that governs everything else, so removing someone removes their access
• Multiple model providers sit behind one interface, so the platform is not locked to a single vendor