This may be the most important page in this guide. It starts with one sentence:
AiAkiv is an outside service, sitting outside your company, and what you store stays there permanently and searchably. That makes "what you store" a security question.
AiAkiv is not a file locker (again)
Nailing down again what What AiAkiv is said. AiAkiv remembers what happened and why: decisions and context. It is not a place to upload whole original documents. Keep that distinction and most security incidents never happen in the first place.
- Good: "We chose session cookies for auth. Reason: XSS defense. JWT was rejected."
- Risky: pasting in an internal design doc, a source file, or a customer list wholesale.
The best use: keep the material elsewhere, only the relationships here
Leave originals where they belong and keep only the relationships and context between them in AiAkiv:
- Code in GitHub, and the process and decisions that produced it in AiAkiv.
- Files in your drive, and a summary of each file in AiAkiv.
- The conversation with the AI itself.
That way the original system keeps the original secure, and AiAkiv remembers only why things ended up this way.
What not to store
Especially in a company or organizational setting, keep these out.
- Company confidential material or original internal documents: specs, full source, internal metrics.
- Third-party confidential information (including your employer's): anything you have no legal right to store.
- Personal data (PII): real names, contact details, national ID numbers. Other people's above all.
- Secrets: API keys, tokens, passwords, certificates.
What AiAkiv can and cannot do (where responsibility sits)
Drawing the line honestly.
- What it cannot do: AiAkiv (or the AI inside it) cannot determine whether you have the right to store a piece of text. Reword it and any automatic detection is bypassed. So the service does not promise to prevent leaks at the source.
- Your part (and your company's): deciding what to store and following your company's policy is the responsibility of the user and their organization. → the terms clause below.
- The controls AiAkiv does provide:
- Cooperation on blocking: every service domain is published so a company can block them, down to which domain actually carries data (see For IT administrators below).
- Refusing to store secrets: obvious secret patterns (key- and token-shaped strings) are rejected on save.
- (Enterprise) approved-organization-accounts-only, SSO, audit logs, and IP allowlists are available on organizational adoption.
The terms clause (in substance)
Users store only content they have the legal right to store. Responsibility for storing a third party's confidential information (including an employer's) without authorization lies with the user.
The exact wording is in the Terms of Service.
If you handle company material
Check your company's security policy before storing company material. If you're not sure, don't. Storing company confidential material in a personal account is usually a policy violation, and the responsibility comes back to you.
For IT administrators: how to block it
To stop employees in your organization from using AiAkiv, block the domains at your network, proxy, or CASB. There are four service domains, and they do different things.
| Domain | What it is | Effect of blocking |
|---|---|---|
mcp.aiakiv.com |
Where the AI attaches: all saving and searching flows through here | Blocking this alone stops data from leaving |
app.aiakiv.com |
The console (team and project management) | Blocks setup and administration |
www.aiakiv.com |
Marketing and setup instructions | Blocks the information pages |
card.aiakiv.com |
Public card pages → Cards | Blocks viewing cards |
If you block only one thing, block mcp.aiakiv.com. The other three are read
and admin screens; no data passes through them. Conversely, blocking only the
console while leaving this one open is not a block at all: AI clients save
without ever touching the console.
For managed adoption (approved organization accounts only, audit logs, SSO, IP allowlists), contact us at [email protected].
Next
- Saving conventions (what to leave, and how) → Saving
- Who can see what inside a team (the permission boundary) → Team sharing