Does any research data leave our workstation? +
No. Experimental data, extracted results, and session records never leave the workstation. The only data that leaves the device during a session is the screenshot sent to the AI model for reasoning and the audit log entry sent to Survon's Swiss-hosted servers in Standard mode (action metadata only — no experimental data). With Private Cloud Routing, even the audit log stays on device and Survon receives nothing during task execution.
What does the Aieia Web Portal have access to? +
The Aieia Web Portal can send task instructions to connected devices and stop running tasks. That is all it can do. It has no access to audit and experimental logs, extracted data, screenshots, or any files on the instrument computer. The portal shows a list of connected devices and their current task status, but cannot read any data from those devices. All experimental data and session records remain on the local instrument computer under your team's control. Admins can see a list of runs, their status, and project/grant codes, as well as credits transactions.
How does the AI model handle our data? +
Aieia sends screenshots and task instructions to the AI model to determine the next action to take. Our AI provider operates a zero data retention policy: screenshots and custom instructions are processed and then discarded immediately after the request completes. They are not stored, logged, or used for model training. This applies to both Standard deployment mode and Private Cloud Routing.
What is Private Cloud Routing and when do we need it? +
In Standard deployment mode, AI inference is routed directly to our AI model provider. With Private Cloud Routing, the same API call is routed through your own AWS or Google Cloud account using Amazon Bedrock or Google Cloud Vertex AI. This means the traffic is subject to your existing cloud provider agreement, visible in your cloud console, and governed by your institution's cloud security controls. Additionally, in Private Cloud Routing mode, audit logs are stored locally on the device. Survon servers receive nothing during task execution. Private Cloud Routing is recommended for institutions with strict data governance requirements or existing cloud agreements that they want to extend to cover AI inference.
Does Aieia work without an internet connection? +
Aieia requires an internet connection during active task execution for two purposes: sending screenshots to the AI model for reasoning (outbound HTTPS only), and writing audit log entries to Survon's Swiss-hosted servers in Standard deployment mode. The Aieia Web Portal also requires connectivity for task dispatch and device management. If the connection is lost mid-run, Aieia stops at the current step and logs the interruption. It does not require any inbound network access and does not expose any network ports.
How are screenshots handled after a session? +
Screenshots are saved locally on the instrument computer in a dated folder within the Aieia application directory. They are not transmitted to Survon servers at any time. Your IT team can manage retention, access, and deletion of these files using your existing endpoint management policies. The screenshots are useful for reviewing what Aieia saw during a session, debugging unexpected behaviour, and providing a local visual audit record of the run.
What if we need to restrict Aieia to specific software only? +
Custom Instructions allow you to set hard constraints on what Aieia is permitted to do. For example: "only interact with the chromatography software, do not interact with any other application", or "read only — do not modify any values or settings." These instructions are applied to every run of that workflow. Screen Region Lock (coming soon) will further restrict Aieia to interact only within a defined area of the screen, preventing it from reaching other open applications entirely.
Can multiple people in our lab send tasks to the same instrument? +
Yes. Multiple authorized people can access the Aieia Web Portal and send tasks to connected instruments. However, each instrument computer runs a single Aieia instance, which can only execute one task at a time. To send a new task to a device, the current task must first be completed or stopped.
How do we report a security concern? +
Email aieia@survon.co with a description of the concern, steps to reproduce if applicable, and any supporting information. We acknowledge all security reports within two business days and provide an initial assessment within seven business days. We ask that you give us a reasonable period to investigate before public disclosure. For general security questions about deployment, data handling, or architecture, the same email address is the right starting point.
