Built to survive your security review
Roles, groups, per-model and per-feature access, a read-only audit log, compliance monitoring built for Law 25 and GDPR: at HiloIntelligence, governance isn't a checkbox added at the end — it's the architecture. Your IT team and your compliance team each find what they're looking for.
- Role- and group-based access
- Per-model and per-feature access
- Read-only audit log
- Built for Law 25 and GDPR
Six gates, on every request
Before a message ever reaches a model it passes six successive checks — the exact order of the code that serves the request, the same order every time. None of them is optional.
- 1AuthenticationSigned session or API key: the request must carry a valid identity. Otherwise it stops right here.
- 2Approved accountThe account has to be approved — pending or suspended is refused. And if you've switched on mandatory training, the required courses must be finished before the rest of the platform opens up.
- 3LicenseThird gate, not the first: the conversation route really is mounted behind a license check, but that check itself demands an authenticated, approved account — so both resolve before it. The user's seat has to cover chat (included from Plan 1 up); with no seat, the request never reaches application logic at all.
- 4Conversation accessThe thread's owner always passes. Inside a project, only contributor-and-above members can continue it, and membership is re-checked on every turn — a removed member loses the thread immediately. Everyone else gets a uniform 404 that doesn't even reveal the conversation exists.
- 5BudgetThe sender's envelope is checked before any model is resolved: going over stops the request on the spot, instead of showing up on the invoice at month end.
- 6Model accessThe last gate, and the finest-grained: the model's global kill switch, then — for non-administrators — required training courses, the policy's failover chain, and visibility: public, admin-only, a chosen selection of users and groups, or "everyone except". Role and group aren't separate steps: they're the criteria this gate consults.
Everything that matters, on the record
The audit log is read-only: the audit API serves reads only — no create, update or delete route exists, for anyone, not even an administrator. Entries are written by the platform itself. Sign-ins, access changes, API key creation, budget alerts, messages sent: every action leaves a timestamped, attributed trace.
| When | Actor | Action | Target | Details |
|---|---|---|---|---|
| Jul 24, 2026, 2:32 PM | camille@company.com | auth.addin_exchange | Outlook add-in | Microsoft 365 SSO sign-in succeeded |
| Jul 24, 2026, 11:08 AM | marc@company.com | chat.create | GPT-5 · Confidential documents | New conversation |
| Jul 23, 2026, 4:44 PM | sofia@company.com | assistant.access_changed | Assistant "Tier-1 support" | Sales group added |
| Jul 23, 2026, 9:12 AM | julien@company.com | api_key.created | API key — internal integration | Scope: read-only |
| Jul 22, 2026, 5:30 PM | system@hilointelligence.ca | budget.alert_fired | Finance group | 80% of monthly budget reached |
Illustrative log — actual data reflects your own organization. For long-term regulatory retention, export to your archiving system: we don't claim a database-level immutable log.
The same policy, applied without exception
Two real requests, two different outcomes: one clears all six gates and becomes a logged conversation; the other is stopped cold at model access. Here is exactly what each one leaves behind.
Request blocked
- Authentication checked: valid session
- Account approved, mandatory training up to date
- License checked: the seat covers chat
- Conversation access checked: thread owner
- Budget checked: inside the month's envelope
- Model access denied — 403 model_not_allowed: no conversation created, no tokens billed, and no audit entry (the refusal goes to the application logs)
Request allowed
- Authentication checked: valid session
- Account approved, mandatory training up to date
- License checked: the seat covers chat
- Conversation access checked: contributor on the Finance project
- Budget checked: inside the month's envelope
- Model access allowed: GPT-5 — written to the audit log as chat.message_sent, with the model and the reasoning effort
Monitoring that spots what shouldn't get out
The compliance monitor reads what your people type: every message is scanned as it goes out — never truncated, not even on a 250,000-token paste, and never as a blocker — and a retrospective scan re-walks the history for the people and date range you choose. It catches passwords, secrets and personal information that were actually typed, offers the author a one-click switch into confidentiality mode on the spot, and surfaces the detection — snippet masked server-side — to your administrators. Built with Law 25 (Quebec) and GDPR in mind. What it examines is the typed words, not attached documents.
| Date | User | Chat | Type | Severity | Snippet | Source | Status |
|---|---|---|---|---|---|---|---|
| Jul 24, 2:32 PM | Camille Roy | Customer support | PII | High | SSN ••• ••• 782 | Live | Confirmed |
| Jul 24, 9:15 AM | Marc Lavoie | Q2 analysis | Password | Medium | password: •••••••• | Batch | Dismissed |
| Jul 23, 4:02 PM | Sofia Garcia | HR report | Custom | Low | client@••••.com | Batch | Pending |
| Jul 22, 11:47 AM | Camille Roy | Customer support | Secret | Medium | key: sk-••••• | Batch | Confirmed |
Illustrative detections — sensitivity and patterns are configured to your own internal policies. The compliance module is an add-on billed at $2 per licensed seat per month, on top of the licenses; the rest of the governance described on this page is included in the platform.
Real controls, not promises
Four verifiable figures instead of a slogan: what the platform actually enforces, on every request and every account.
- 0
- successive checks on every send, in this order: authentication, account status, license, conversation access, budget, model access
- 0
- categories caught by compliance monitoring: passwords, secrets, personal information, custom patterns
- 0
- single sign-on identity providers supported: Microsoft and Google
- 0
- role tiers — user, manager, administrator — plus the super-admin flag
Every control lever, in one place
A single administration portal brings together every governance lever on the platform.
Roles & permissions
User, manager, administrator — three tiers, plus the super-admin flag — that follow your org chart.
Groups & managers
Group your teams, and put managers in charge of following their own direct reports. Managing the groups themselves stays with administrators — by design, so a delegation never becomes a back door.
Per-model access
Public, admin-only, limited to a chosen selection of users and groups, or "everyone except" — model by model.
Per-feature access
The same fine-grained control covers 35 features — image, video and audio studios, automation, API keys, Office add-ins — with one extra mode: fully hidden.
Licenses & budgets
Seats per plan, a default budget on first sign-in, consumption kept under watch.
Audit log
Read-only — the API exposes no write at all — timestamped and exportable: the traceability your auditors expect.
Compliance monitoring
Automatic detection of passwords, secrets and personal information in the messages your people send — live, or by re-walking the history. Built for Law 25 and GDPR.
Microsoft and Google SSO
Single sign-on with your existing identity providers — no extra password to manage.
The one-page summary for your security team
Print it or forward it to your CISO, your compliance team or your business partner — the essentials of HiloIntelligence governance at a glance.
Inside this sheet
- 1Roles, groups and managers
- 2Per-model access
- 3Per-feature access
- 4Licenses and budgets
- 5Read-only audit log
- 6Compliance monitoring
Ready to make governance an advantage?
Governance shouldn't slow adoption down: done right, it speeds it up. Talk to our team or launch your instance now — it's active from day one, never bolted on afterward.
Need private hosting?What Law 25 requires, section by section