Permission-aware RAG for your own data

Your AI assistant can see everything.
Your users can't.

Put AI on your database without leaking data across users or tenants.

Row-level access. Multi-tenant isolation. PII masked before the model reads a row.

Most "AI over your data" tools flatten permissions the moment they retrieve — so the assistant sees every row, and the wrong user gets the wrong answer. Knodox is the permission-aware retrieval layer: every user gets grounded, cited answers from exactly the rows they're authorized to see, enforced before retrieval — not in the UI. Multi-tenant isolation by architecture, PII masked pre-model, and every figure verified against live data. Self-host it or run it managed.

For B2B SaaS platforms and mid-market → enterprise teams putting AI on their own data.

No signup — sign in as different roles and watch the same question return different answers. Or talk to the founder — no pitch, just the builder.

Every figure verified — no hallucinations Your identity provider, your roles Isolated workspaces, by design Every answer provable & replayable to the row Self-host or managed
PII masked before the model reads a row Isolated workspaces by architecture Connects to any identity provider Every answer, in the audit log Every figure verified — no hallucinations Read-only by design Self-host or managed

Dashboards report. Search retrieves. Knodox reasons.

Ask the questions your dashboards can't answer. Knodox understands how your data connects, explains what patterns mean, and delivers grounded, cited answers you can prove — so your team can decide with confidence, across every system your business runs on.

Why Knodox exists

The challenge with enterprise AI isn't intelligence — it's trust.

Business leaders need confidence that employees only see what they're authorized to access, that answers are based on trusted company data, and that every interaction is traceable for security and compliance.

Knodox makes enterprise AI trustworthy by combining tenant isolation, role-based access control, grounded retrieval, source attribution, and comprehensive audit logging into a single platform.

The right user. The right data. The right answer. Every time.

The Product

One AI. Every system.
Every permission enforced.

Knodox brings your organization's knowledge into a single AI experience. It searches across connected data sources, enforces workspace isolation and PII policy before any data is retrieved, and delivers accurate, cited answers that users can trust.

Ask in plain English

No SQL, no dashboards to build, no waiting for a data engineer. Ask "which units have the highest maintenance backlog?" and get an answer in seconds.

Grounded, cited answers

Every answer is grounded in real data pulled from your systems, with sources cited inline. Every question and every source it touched lands in the audit log.

Verified, never invented

Every figure in an answer is checked back against your live data after it's written — and flagged the moment one can't be traced to a real row. If a question can't be answered from your data, Knodox says so instead of guessing. No hallucinated numbers.

Permission-enforced at every layer

Groups from your identity provider map to Knodox roles. Every query is enforced by workspace boundary and PII policy — at the retrieval layer, not in the UI. Sensitive fields are masked before the model reads a single row, deterministically, on every answer.

The permission indicator

Every answer carries a badge — workspace, role, PII masking status — so your team sees exactly what scope produced it. See how it works →

Answers that become dashboards

Pin any answer to a dashboard and it stays current — KPIs, charts, and an executive brief built from the questions your team actually asks. No dragging fields into a BI tool; your best answers, kept live and shareable.

Notebook-style workspace

Mix natural-language questions, structured queries, document search, and notes on a single page. Build a living workbook that your team runs and shares — with every answer bound to the workspace's policy.

Infrastructure, not an app

Built to embed, not to open. B2B SaaS platforms can embed Knodox as their AI layer — every one of their customers gets an isolated workspace with their own roles from day one, without a second product to log into.

How It Works

Your identity.
Your roles. Your rules.

Knodox connects to your existing identity provider. Your IT administrators map existing groups to Knodox roles using a self-service setup — no custom engineering required.

When users sign in, their identity and permissions are automatically applied to every query. Knodox enforces access policies before retrieving data, ensuring users only see what they're authorized to access.

Your identity provider
Your existing user directory, no changes needed
where your users already live
Isolated workspace
One per team or customer, identity-provider ready, signed access tokens
provisioned once, scales with you
Role mapping
Identity-provider groups → Knodox roles, configured self-service
no custom engineering required
Enforced queries
Workspace-isolated, PII-scoped, grounded — on every request
automatic, on every request
Connect anything

If it's in your systems,
Knodox can already ask it.

Your data stays where it is. Knodox reads a copy — read-only, always — understands its structure, and prepares it for search. Three connector families cover most of where day-to-day business data lives.

Business databases

Connect the systems that run your business, with read-only access. Knodox syncs updates incrementally and refuses any credential that has write access — checked before the connection is even saved.

Incremental sync

Spreadsheets & exports

Upload any CSV or spreadsheet — an export from QuickBooks, Xero, SAP, or a custom report your team already runs. Knodox works out the column types, lets you flag sensitive fields, and makes it askable in minutes.

Drag and drop

Business apps & APIs

Point at any product your team already uses — Stripe, Jira, HubSpot, Zendesk, or an internal service. Knodox handles authentication, pagination, and refreshes — no engineering work needed to keep the data flowing.

Any SaaS product
See it in action

From a question
to a living dashboard.

Ask in plain English, get a grounded answer with every figure verified and its sources cited — then pin it to a dashboard that keeps itself current. Here's the same property-ops workspace, end to end.

The answer, with its receipts

Every figure checked back against live data, sources cited inline, and a badge showing the exact scope that produced it.

A dashboard that stays current

Pinned answers become an executive brief, KPIs, and charts — each scoped to the viewer's role, refreshed on demand. No BI tool, no drag-and-drop.

The real thing — not a mockup

Open the receipts on any answer.

Straight from the product — click any screenshot to zoom in.

Every figure, traced to a query.

The model and cost, the exact query steps run under your access policy, and a figure-by-figure check — here 13 of 19 figures trace directly to a query result. The numbers come from your data, not generated by the AI.

A dashboard that stays current.

Pinned answers become an executive brief that surfaces what moved, a KPI strip, and charts — each scoped to the viewer's role and refreshable on demand. No BI tool, no drag-and-drop.

The permission indicator

Transparent Access.
Trusted Answers.

Every answer clearly shows why a user can see it.

Unlike most AI tools that enforce permissions behind the scenes, Knodox makes access explicit. Every response includes a permission badge showing the workspace, the role, and the PII policy that determined the result.

This isn't just metadata — it's proof that security policies were enforced before the AI accessed any data. Compliance teams gain complete visibility, users gain confidence, and every interaction becomes fully auditable.

Every AI answer, every structured query, every search result:
tenant
The customer this data is isolated to. Nothing from another tenant is reachable — not by the query, not by the AI.
role
Resolved from the user's group in your identity provider at sign-in. Each role carries its own PII policy and audit visibility, configured by your workspace admin.
PII
Sensitive fields (personal data) are masked before the answer is composed — not just hidden in the UI. The AI never sees the raw value.
Stored in the audit log with every query result. Exportable for compliance review.
Security & compliance

Built for teams that
audit before they adopt.

Every control is wired into the platform — not on a roadmap, not behind a sales conversation. Here's the short version; the full model is one click away.

SOC 2 on our roadmap

Security, availability, and confidentiality controls built to the SOC 2 Type II standard. Formal certification is on our roadmap.

Tenant workspace isolation

One isolated workspace per team or customer, signed with per-workspace keys. Cross-workspace access is impossible, not merely disallowed.

Permissions & PII at the data layer

Roles map from your identity provider; every query is scoped before retrieval and sensitive fields are masked before the model reads a row.

Full audit log

Every login, role change, connector, query, and answer is recorded with user, tenant, and scope — exportable for compliance review.

Self-host or managed

Deploy the whole stack with one command, or let us run it. Bring your own storage, file store, and AI provider — and we never train on your data.

Read-only & clean deletion

Connections are rejected if the credential can write. Removing a source deletes its records and search index together — verified and audited.

Read the full security model Security-review FAQ
Use cases

One engine.
Every workspace stands on its own.

Your team, your business unit, or your customers — the isolation and role-mapping work the same in any industry. Find the one closest to you.

Property management
Cornerstone Property Group
workspace: cornerstone
Leasing group → leasing_agent
Maintenance group → work_order_lead
Finance group → property_controller
Legal
Hargrove & Ellis LLP
workspace: hargrove
Litigation group → litigation_associate
Corporate group → corporate_analyst
BillingTeam group → billing_manager
Healthcare
Riverside Medical Center
workspace: riverside
Clinical group → clinical_provider
Billing group → billing_analyst
Pharmacy group → pharmacy_viewer
Explore all industries
For B2B SaaS platforms

Add governed AI without rebuilding your stack.

You already have customers, users, roles, and your product database. Knodox slots in as the AI layer — so every one of your customers gets governed, permission-aware answers over their own product data, isolated by tenant from day one.

Your platform today
Customers Users Roles Database Business logic
Your platform with Knodox
Customers Users Roles Knodox Governed AI over their product data
See partnership options
Design partner program

Now onboarding a small group of design partners.

We're working hands-on with a select set of early teams — mapping their identity provider, connecting their first data source, and shaping the roadmap around real security reviews. Limited spots.

Apply to join
Why partner with us

Add value to your business,
and your customers.

Partner with Knodox to give your customers governed, permission-aware AI on their own data — grounded, provable, and isolated per tenant — while opening new revenue for your business. Resell it, refer it, or embed it as the AI layer inside your own product.

Ship cutting-edge AI, not a trust liability

Give your customers real-time answers over their own data — permission-scoped, grounded with no hallucination, and provable to the row. You get the decision layer without building the permission engine, grounding verifier, or audit ledger yourself.

Unlock new revenue

Flexible models that fit how you go to market: resell Knodox, refer deals for commission, or embed it as your own AI layer — with every one of your customers getting an isolated, role-aware workspace from day one.

Dedicated partnership support

From onboarding and technical enablement to co-marketing and hands-on integration, our team is with you at every step — including helping your customers clear their security reviews.

Become a partner

See it enforce on your own data.

Start in the live sandbox — sign in as different roles and watch the same question return different answers. No signup, no sales call. When you're ready, book a thirty-minute walkthrough on your own data, or talk to the founder directly — no pitch.