CZ Test your AI
Inovai Platformrunning Testing, monitoring and evidence in one placeIt attacks your AI after every change and documents every finding. How the platform tests

AI security

AI inventoryEverywhere AI runs in your company, including the unapproved Chatbot and agent testingModel, widget code and data flow, before deployment and in operation Copilot auditPermissions and data leaks in Microsoft 365 Monitoring and evidenceA new run after every change, a report for the auditor OSINT investigationWhat an attacker finds about you and your people

AI integration

Digital colleagueA chatbot for your website and e-shop, and an in-house colleague on top of data and BI AI workflows and agentsConnections to ERP and CRM, agents that write and send Copilot StudioCustom agents in Microsoft 365 Local modelsData never leaves the company

Document extraction

Invoices and ordersExtraction and export to ERP without retyping Contracts, certificates and delivery notesData and deadlines, 10,000+ certificates at Favex Production ordersFrom email through the order to production documents Checks against rulesERP, standards and contracts, exceptions for approval

BI and data

Power BI and Qlik SenseReporting that management actually opens Data platformFabric, Databricks, data warehouses AI on top of reportsCopilot in Power BI and data agents Forecasts and recommendationsDemand forecasting, recommendations, anomalies

Workshops and analysis

Analysis and solution designWhere AI saves time and money, and how to build it AI for managementWhere AI makes sense and where it doesn’t Secure AI for ITAttacks, defence and evidence in practice AI literacy for teamsSafe use of AI, Article 4 of the AI Act
All areas

When you’re dealing with

We’re launching a chatbot or agentPre-deployment testing, retest and evidence for management We’re rolling out CopilotBefore Copilot finds what it shouldn’t We’re buying AI from a vendorTesting before you sign off acceptance We don’t know where AI is runningAn inventory of deployed and unapproved AI An audit or inspection is comingEvidence for the auditor, Czech National Bank or NÚKIB

Industries

Banks and insurersDORA and Czech National Bank supervision Public sectorChatbots for citizens, Copilot in public offices HealthcareSensitive data and the higher-obligations regime Energy and industryAgents on operational data

Partners

Chatbot vendorsSecurity testing under your brand Integrators and IT vendorsAI testing for your projects Law firmsTechnical partner for the AI Act

Evidence

Favex case studyAI we built: 10,000+ certificates in production Use casesEighteen situations, from chatbots to invoices Czech AI Security IndexHow easily models are bypassed in Czech, in progress

Company

TeamFour people, AI, data and security How we workConnect, attack, verify, document BlogFrom practice, no hype

Infrastructure

Coming soonGPU server in CzechiaLocal models, fine-tuning and attack testing without cloud APIs.What it will run

Inovai / AI integration

Data can’t leave. You still want AI.

Model, data and tests on your server. We’ll tell you openly where a local model falls short and where it doesn’t.

Request a local modelWhen a local model makes sense
Your server / no internetdata never leaves the building
Language modelfine-tuned on your task
Vector databasedocuments and permissions
Judge modelevaluates answers
Testing platformattacks and evidence
Outbound internet traffic: none
Problem

Some data must not go to the cloud: client data, health data or know-how.

What we’ll do

A model fine-tuned on your task, measured and tested on your premises.

Result

AI with no outbound traffic and proven quality.

What you get

The whole chain on-premises, decisions based on measurement, the same tests as in the cloud.

Data never leaves the companyThe model, vector database and judge model run in your data centre. Fewer vendors you have to trust.
Numbers, not impressionsWe compare a local and a cloud model on your documents and queries. You decide based on measurement.
The same attacks as in the cloudAttacks via prompts and documents work locally too. We attack the model before launch and again after changes.

How we decide

Four steps, and at the end you know whether it makes sense.

deviation
Step 1Data classificationWhat is sensitive and what isn’t. Sometimes only part of the chain needs to run locally.
Step 2Measured on your taskLocal versus cloud model on your documents and queries. Results in a table.
ModelGPUUsers
Step 3Hardware designModel size, number of users, peaks. We work it out on your task before you buy.
Finding confirmed by a humanReproduction attached
Step 4Deployment and testingInstallation, permissions, the same attacks as in the cloud. Report, retest, ongoing administration by agreement.Verified by a human

A local model is weaker than the largest cloud models, especially in general reasoning. On a narrow task with fine-tuning, the gap shrinks or disappears.

FAQ

Our own GPU server in CzechiaLocal model vs. cloud AIInovai PlatformDocument extraction
Is a local model more secure?

Data never leaves the company, that much is certain, but attacks via prompts and documents work just as they do in the cloud. That’s why we attack a local model too, before launch and again after changes.

What hardware do we need?

For document extraction, one server with a GPU is enough; a company assistant for hundreds of people needs more. We calculate it on your task before you buy.

We have no GPUs of our own. Can we still do it?

Yes. We’re preparing our own GPU server in Czechia, where the model will run without cloud APIs. Once you have your own hardware, we’ll move it to you.

Can’t we combine the two?

Yes, and it’s often the best option: the sensitive part locally, the rest in an EU cloud. Data classification decides, not habit.