Security & governance
Privacy and auditability are not features bolted on at the end — they are constraints we designed against from day one.
Data sovereignty
Lens is deployed inside your network. SAP rows, prompts, and results flow between components you operate. There is no required outbound connection to a vendor cloud, no telemetry pipe carrying business data, and no shared multi-tenant backend.
When a hosted AI model is configured, sensitive objects are filtered out of prompts before the call is made. The decision is made by policy, not by the model itself.
AI models & sensitive data
Lens runs at least two distinct tiers of AI models. The privacy regime that applies to a model is determined by where it runs — not by who the vendor is, not by what the prompt looks like.
One large model handles free chat, schema interpretation, NL → query planning. It can be a hosted provider or a local open-weights model.
is_sensitive in the
catalogue are stripped before the call leaves your network.
No row-level PII or otherwise classified data goes outbound.Algorithms call small, task-specific models hosted locally — log classification, error clustering, embeddings, redaction, extraction. Different algorithms can use different models.
Access control
Every user authenticates against Lens, every SAP call is bound to that identity, and every privileged action requires an explicit permission.
Local accounts or your existing identity provider. Sessions are signed and short-lived.
Permissions are atomic and assigned via roles. New capabilities ship with their own permission keys.
Calls execute under the user's SAP identity. Lens never elevates beyond what the user is allowed to see.
Out of the box, Lens offers no write paths to SAP — production data cannot be modified through the product surface. Write capabilities can be enabled selectively, per customer and per use case, under explicit agreement.
Auditability
Every meaningful action — login, query, algorithm run, admin change, export — is recorded with the originating user, timestamp, outcome, and enough context to reproduce it. Audit data is dual-written so a single failure cannot erase the trail.
Lens is designed to align with the obligations enterprises already face — works council scrutiny on HR analytics, EU AI Act risk classification, internal audit reviews. Each registered algorithm declares its sensitivity, decision-support scope, retention period, and explainability notes up front, and runs are tagged accordingly.
Operational trust
A small, well-named set of services. Each one does one job. Operators always know which box answered which question.
Schema and configuration changes are migration-driven. Rolling back a release rolls back the data shape with it.
Errors surface to users with a clear cause. Operators see the same context in logs — not a different story.
The product never writes to SAP and never enriches itself with customer data behind the operator's back.