What protects your files — named, explained, verifiable

The principle, in one sentence

Your work stays under your control, end to end

LEMIA is software that runs on your own computer. The AI work is entrusted, without exception, to a Swiss operator; the software publisher never sees your texts; and nothing is sent unless you have said yes, while every change to your files can be undone. Every measure below is simply a concrete way of keeping those three commitments.

The measures, in plain words

What each protection does

Each card describes a protection that LEMIA is designed to provide — a best-efforts obligation, not a promise of results. We start with what each one prevents; what makes it hold is named further down, in the technical detail.

In one diagram

Several layers between the world and your files

The measures above interlock: to reach your files, every one of these layers would have to be crossed, one after the other.

The buffer zone

Two possible outcomes — only one leads to your files

The new documents the agents produce wait in the buffer zone. From there, only two outcomes: you approve, and the result is written to your files; you refuse, and it is written nowhere. Your decision is the only route by which a new document reaches you.

A document that already exists, which you ask to have corrected, renamed or deleted, does not go that way: the operation applies straight away, to the very object you designated. What protects you there is not the wait but the way back: a copy of the original is set aside before any change, and if that copy cannot be made, the write is refused.

The named detail

What we use, precisely

Each line below names what we use — in the open, and with its limits: enough to check, point by point, every promise this page makes.

What reaches the publisher

An allowlist, closed by default

For the licence to work, a few technical markers leave your computer. They do not go through a filter that removes what is forbidden — it is the opposite: only explicitly allowed fields pass, and any unforeseen field is rejected. Automated tests fail if content crosses that boundary, and the separation is re-checked on every change to the software.

run     4f2a…             step     3 / 5
status  done              tokens   1,240 in / 380 out
time    12.4 s            verdict  accepted

That is what we see. What never appears in it: your texts, your instructions, the content produced, and even the names of your files.

Three common confusions

What looks alike, and is not equivalent

The vocabulary of confidentiality is now shared by the whole market. Three distinctions nonetheless decide what actually protects you. Put them to any vendor — including us.

Sovereignty

Hosting in Switzerland is not enough. Sovereignty is

For a professional bound by secrecy (Art. 321 of the Swiss Criminal Code), the real test is not where the servers sit, but who can be legally compelled to grant access to them. Hosting data in Switzerland answers a data-protection question. But hosting it also means entrusting it to a provider. Professional secrecy then asks another one: can that provider be compelled to open your files? A “Swiss region” operated by a group subject to foreign law remains exposed.

The law that binds you, by profession

Every profession has its secret — and its article of law

The core of the law that binds you often fits in a single article: Art. 321 of the Swiss Criminal Code punishes whoever unlawfully discloses a secret entrusted to them in the practice of their profession — an offence prosecuted on complaint, punishable by a custodial sentence of up to three years or a monetary penalty. It covers a closed circle of professions; other regimes add to it or extend it. A reassuring point: auxiliaries are themselves bound by secrecy (Art. 321 para. 1 of the Swiss Criminal Code) — that is what makes their access lawful — and disclosure remains non-punishable with the consent of the person concerned or the written authorisation of the superior authority (para. 2).

Data protection, on top

The FADP adds to secrecy — it does not replace it

On top of professional secrecy sits a second, cumulative regime: the FADP. It applies to any personal data, and its requirements bind you whether or not you fall under Art. 321.

What LEMIA does with it, in one sentence: your content is processed in Switzerland, by design and without exception; it is never read by the publisher, and every output is reviewed and approved by you before anything is sent, and every write to your files can be undone. Sovereign processing answers the question of transfers abroad; human approval answers the question of automated decision-making; and the fact that your content is never read, together with the data processing agreement, answers professional secrecy and the FADP.

Verifiable guarantees

Every promise has its clause, and its proof

We do not ask you to take our word for it: every commitment below is written into our Terms of Use — and therefore enforceable — and matches a mechanism in the product that you can see for yourself during a demonstration.

What we do not claim

Trust is also earned by stating the limits