Connected directly to your systems. Not bolted on.
Agents get what they need where it lives: mailbox, database, ERP, file share. Sign-in and permissions come from your directory, and you choose AI services per data zone. No export, no import, no shadow copies.
In brief
How does the AI reach your systems without an export?
Video transcript
Hi, I'm Neva, your personal assistant. How does the AI reach your systems without you having to export anything?
Agents get what they need where it lives. Integration is just another tool step, with a data zone and tracking.
There are four ways. REST APIs, for example to your ERP or ticket system. Databases, with parameterized SQL queries on Microsoft SQL Server and MySQL. Email and Microsoft 365. And files and file shares.
Sign-in and permissions come from your directory, for example Active Directory or Entra ID. The connection layer is modular and extensible. And you choose AI services per data zone, local or external.
No export, no import, no shadow copies. Your data stays where it is.
Four ways into your systems
Tools that connect, as a step in any pipeline.
In MadeForPrivacy, integration is not a special project but a tool step like any other: with input and output types, a data zone and tracking.
REST APIs
The API tool calls any HTTP interface, with authentication, retries, multipart and raw data uploads. Accounting, ERP, ticket system, Microsoft Graph: one tool, configured per step.
apiDatabases
Parameterized SQL queries against Microsoft SQL Server and MySQL. Order numbers from the briefcase go into the query as parameters, never as text in the SQL.
databaseEmail & Microsoft 365
Connect mailboxes, process attachments, draft and send replies; save files to SharePoint/OneDrive. Groups and sign-in via Entra ID.
mail-processor · mail-send · graphFiles & file shares
Connect network drives and file interfaces, process and file documents, Handbooks as a Git-backed repository with remote push. The knowledge stays where it is maintained.
document-processor · handbookIdentity & access
Your directory decides who may do what.
No second user directory: sign-in runs through your identity service, and access to agents, Knowledge and Handbooks through your groups. The provider layer is modular. If something is missing, we connect it at short notice.
Active Directory & Kerberos
Domain sign-in without a password prompt: Kerberos SSO in the desktop client, groups straight from AD.
LDAP
Directory server with bind and user search: base DN, filter, group mapping, bind password from Vault.
Entra ID, OAuth & OIDC
Sign-in via your identity provider, groups via Microsoft Graph. Google Workspace and other OIDC providers work the same way.
RADIUS & more
Providers are modules with a shared interface. RADIUS, a local IdP or a special case in your environment: can be connected without rebuilding anything.
Fixed API keys
Long-lived service keys for scripts, integrations and service accounts, with group assignment, rotation and revocation.
Groups instead of roles
Every agent, dataset and Handbook carries its groups. When someone changes groups in AD, their permissions change immediately, with no maintenance in the product.
AI services
The model is interchangeable. The rules are not.
MadeForPrivacy connects local models, models via Microsoft Azure (EU) and providers such as OpenAI, Anthropic and Google. Every AI service is set up with provider, model, rate limit, cost and data zone. Tools only use services that meet their zone. When a new model such as GPT-6 arrives, you add one entry. The pipelines stay as they are.
You sign the contract with the AI provider yourself.
MadeForPrivacy connects your access: the keys stay in your Vault, and every service gets a data zone. NeckarByte does not resell model access; you pay the token costs directly to the provider.
The models run on your servers. No text goes to an external provider.
Ollama
- Qwen3-30B-A3B, Qwen3.8 27B, Qwen3-14BText
- gpt-oss-20bText
- Mistral Small 3.2 24B, Gemma 3 27BText
- Llama, DeepSeek and other open modelsText
Hugging Face / TEI
- Embedding models for searchEmbeddings
ComfyUI
- Local image models, for example FLUXImage
Open decision models
- H2O-Lightning-4BDecision
With an EU data zone in your own Azure account.
OpenAI
- GPT-6 Astra, GPT-6 Sol, GPT-6 LunaText
- GPT-5.6 and earlier GPT-5 versionsText
Mistral AI
- Mistral Large 3Text
Black Forest Labs
- FLUX.2 ProImage
Microsoft
- MAI-Image-2.6, MAI-Image-2.6-FlashImage
- Microsoft-Decision-1Decision
Which zone a provider gets depends on your contract with it. The usual choice is Unprotected.
OpenAI
- GPT-6 Astra, GPT-6.1 Sol, GPT-6 LunaText
- GPT-5.6 and earlier GPT-5 versionsText
- GPT-Image-2.5, GPT-Image-2Image
Anthropic
- Claude Fable 5.1, Claude Opus 5.5Text
- Claude Sonnet 5.5, Claude Haiku 5.5Text
- Gemini 4 ArgonText
- Gemini 3.8 Flash, Gemini 3.5 Flash-LiteText
TypeSafe
- Jev 1.14Decision
OpenAI-compatible endpoints
- Any service with an OpenAI-compatible API, local or externalText
Claude, Gemini and Jev can be connected. Whether you use them is something we clarify in the integration check.
You decide which zone a service gets, based on contract, region and data. The assignment shown here is the usual one. Model names as of October 2026.
From real-world operation
Three integrations as they actually run.
All three use the same building blocks: document and mail processing, extraction, API and SQL tools. The difference lies in the pipeline, not in custom development.
Incoming invoices
Document → accounting & DMSThe invoice agent processes invoices from the connected mailbox or a file share (as an email, PDF, scan, photo, Excel, CSV or Word file), extracts the invoice data, checks it, files the document (e.g. in the DMS) and hands it over to accounting.
- Mail processor & document processing
- Extraction with schema validation
- Filing via Graph, hand-over to accounting via REST
Order capture
Order → ERPOrders arrive as an email, PDF, scan, photo, screenshot, Excel, CSV or Word file, are captured in structured form, checked against master data and handed over to the ERP via EDI, via API or as a file in your in-house format.
- Item and customer numbers validated via SQL
- Hand-over via API or file
- Every transaction traceable in the tracker
Support & CRM
Ticket → draft replyAn agent pulls context from the ticket system and CRM, searches the knowledge base and drafts a reply, entirely locally if you wish.
- Context via API and SQL tools
- Knowledge from RAGFlow with source citations
- Local models for sensitive customer data
API & automation
Trigger agents from your processes.
Every agent can be called via REST: from your ERP, DMS, ticket system or a script. The response comes as a stream or as JSON, and every call runs as a job with tracking. And for everything that happens regularly, workers check for new entries on their own.
- One endpoint per agentPOST /agents/{tag}/execute, with prompt, files and pre-filled briefcase items.
- Service access with fixed keysGroups determine which agents a key may run.
- Workers & jobsScheduled discovery finds new tickets, orders and emails and queues one agent run per entry.
# Capture an order from the mailboxPOST /api/agents/order-agent/execute Authorization: Bearer <service-key> Accept: text/event-stream { "prompt": "Capture the order in the attachment.", "files": [{ "name": "bestellung_b-2026-1048.pdf", ... }] }# Response: stream of steps, then the resultevent: step file-content-extractor · completed event: step order-extractor · order event: result { "order_number": "B-2026-1048", "items": [ ... ], ... }
Frequently asked questions
Questions about AI providers and data zones.
Can I use GPT-6 in line with data protection rules?
Yes, via Microsoft Azure with an EU data zone: Microsoft offers GPT-6 Astra, GPT-6 Sol and GPT-6 Luna there with processing in the EU. You sign the contract with Microsoft, add the model as an AI service in MadeForPrivacy and approve it for the GDPR-compliant zone. It never sees data from the Local only zone; local models via Ollama handle that.
Which AI providers does MadeForPrivacy support?
Locally, Ollama runs open models such as Qwen3-30B-A3B, Qwen3.8 27B, gpt-oss-20b, Mistral Small 3.2, Gemma 3, Llama and DeepSeek, plus Hugging Face / TEI for embeddings, ComfyUI for image models such as FLUX and H2O-Lightning-4B as an open decision model. Via Microsoft Azure (EU) you use GPT-6 Astra, Sol and Luna, GPT-5.6, Mistral Large 3, FLUX.2 Pro, MAI-Image-2.6 and Microsoft-Decision-1. Directly connectable are OpenAI (GPT-6 Astra, GPT-6.1 Sol, GPT-6 Luna, GPT-Image-2.5), Anthropic (Claude Fable 5.1, Opus 5.5, Sonnet 5.5, Haiku 5.5), Google (Gemini 4 Argon, Gemini 3.8 Flash, Gemini 3.5 Flash-Lite), TypeSafe (Jev 1.14) and any endpoint with an OpenAI-compatible API.
Who signs the contract with the AI provider?
You. MadeForPrivacy connects your access, and the keys stay in your Vault. NeckarByte does not resell model access and earns nothing from your usage. You pay the token costs directly to the provider, more under Pricing.
Can I connect Claude or Gemini?
Yes. You can connect Claude from Anthropic (Claude Fable 5.1, Opus 5.5, Sonnet 5.5, Haiku 5.5) and Gemini from Google (Gemini 4 Argon, Gemini 3.8 Flash, Gemini 3.5 Flash-Lite). You decide which zone they get based on your contract with the provider. The usual choice is Unprotected, meaning content that needs no protection.
Live demo
Does MadeForPrivacy fit your IT landscape?
In the integration check, we go through your systems, your directory and your data zones and tell you honestly what works right away and what we need to connect.