Why Tracium runs
on your servers.

Why is ship documentation controlled data?

For a naval vessel, the technical documentation describes how the ship’s systems are built, run and repaired. Much of it counts as controlled technology under export rules, and many programmes add security classifications on top.

US export rules say so outright. Under ITAR, technical data is information required for the design, production, operation, repair, testing, maintenance or modification of defence articles, including instructions and documentation. A maintenance manual for a defence article fits that description almost word for word.

In Europe, national export controls follow the Common Military List of the European Union. Category ML9 covers vessels of war and special naval equipment. Category ML22 covers the technology required to develop, produce, operate, install, maintain, repair and overhaul the items on the list. The maintenance procedures of a frigate are that kind of technology. Which rules navies set for the documentation itself is in S1000D in naval shipbuilding.

What happens when a cloud AI reads your manuals?

A general AI service runs on its provider’s servers. To draft from a manual, the model has to read it. The text leaves your network and is decrypted and processed on hardware you do not control, often with logs kept for a while. A promise not to train on your data does not change where the data went.

This is not a theoretical risk. In May 2023 Samsung banned generative AI tools for its staff after employees had uploaded sensitive source code to ChatGPT, as CNBC reported.

ITAR does have a rule for the cloud. Sending or storing unclassified technical data is not an export if it stays end-to-end encrypted and no third party is given the means to decrypt it (22 CFR 120.54). A language model cannot work on encrypted text. A provider that drafts from your manuals holds them in clear text, so that rule cannot cover the drafting.

Whether a given use needs a licence is for your export control officer to decide. The point is that the question arises the moment the manuals leave your network.

Is a private or sovereign cloud enough?

A cloud region in your own country, or a provider that promises not to look, changes the provider, not the principle. For controlled data, three questions decide: who operates the hardware, who can get hold of the keys, and which law the operator answers to.

The third one is easy to miss. Under US law, a provider based in the US has to disclose data in its possession on a lawful request “regardless of whether such communication, record, or other information is located within or outside of the United States” (18 U.S.C. 2713, added by the CLOUD Act in 2018). A data centre in Europe does not change that. On your own servers, the answer to all three questions is you.

What does on-premise mean in Tracium?

Tracium runs on your own infrastructure. The language models, the supplier manuals, the drafts and the finished data modules stay on your servers. Tracium does not call a cloud service or a third-party AI.

Your IT decides where the data sits and who has access to it. Access inside Tracium is role-based, so writers, reviewers and approvers each see what their role allows. Your security team reviews one system inside your network, not a chain of outside services and the companies they in turn rely on.

The same rules for the AI as for the writers

Your writers work on approved systems inside the yard. An AI that drafts for them should work under the same rules. That is why Tracium comes to the documents, not the other way round.

What to ask any AI documentation vendor

Whoever you talk to, these five questions show quickly where your data would go:

1. Where do the models run, and who operates the hardware?
2. Does any text, prompt or log leave our network, for support or monitoring as well?
3. Which other companies can see our data?
4. Does the system work without a connection to the internet?
5. Who holds the keys, and who can decrypt what?