SAITO AI · architecture, limits and governanceHow SAITO's copilot is being built
Here we explain in detail how it treats your data, where it does not go and what guarantees you have as an organisation.
Data architecture
Per-entity isolation, per-role context
The copilot never sees another club's data. And inside your club, it only sees what the user's role is allowed to query.
Per-entity tenant
Every club, federation or university operates in its own logical space. No mixing between entities and no retraining with third-party data.
Role permissions before the AI
The same rules that apply to screens apply to the copilot: if a role cannot see a piece of data, the copilot cannot read or summarise it either.
Traceability for every query
Every copilot request is logged with user, context and data queried, available for internal audit.
Limits by design
Where the copilot does not go
Not everything that can be automated should be automated. These are the limits we set from product design.
Out of the clinical health block
The copilot can know the operational status (fit / not fit for a session), but never the clinical cause. It does not produce diagnosis, treatment or medical clearance: that always stays with the authorised health professional.
Sensitive actions with human confirmation
It can draft communications, create call-ups or propose plans, but any action that impacts members, families or accounts requires explicit confirmation by an authorised role.
Governance
You decide what to enable and for whom
The copilot is not a single switch: you can enable its capabilities per module, per role and per section, and turn them off whenever you want.
Granular activation
Turn the copilot on only in the modules where it adds value. It ships turned off by default.
Data residency in the EU
SAITO is designed for data residency in the European Union and to align with GDPR. The final configuration is confirmed with each Early Adopter.
No lock-in exit
You can export your organisation's data at any time and disable the copilot without losing any operational feature of the product.
