Security, Privacy & Architecture Overview

Answir is deployed directly on a client’s website as a secure, read-only AI assistant. It is designed to operate within clearly defined information boundaries and is suitable for use in regulated, disclosure-sensitive environments.

Answir is delivered via Cloudflare’s global infrastructure. Cloudflare is a widely trusted enterprise-grade cloud platform used by millions of websites worldwide, including financial institutions, governments, and public companies. Cloudflare provides:

• Network-level security and DDoS protection;
• Web application firewall (WAF) capabilities;
• Secure content delivery and isolation from client web infrastructure; and
• High availability and global redundancy.

Answir’s deployment does not require access to a client’s servers, databases, or administrative credentials. The assistant is embedded via lightweight code and operates independently from the client’s core systems.

Answir currently uses OpenAI’s GPT-5.2 large language model (“LLM”) as its underlying reasoning engine. Answir frequently upgrades its underlying LLM in order to provide a better user experience. The LLM is accessed via secure API calls and is not trained on client data. Client content is used strictly for retrieval and response generation within the client’s isolated environment.

Answir is designed to avoid hallucinations by constraining responses to a defined knowledge base consisting of:

• Authorized company disclosures and investor materials;
• Web content via links selected by the client; and
• Structured stock data and other information, where enabled.

Further, all responses are cited to their source document(s), which can be selected by the client to be shown or not shown, depending on their preference. If a question falls outside the available knowledge base, Answir is designed to respond by indicating that the information is not available rather than speculating or generating unsupported claims.

All client-provided information used to configure an Answir agent remains confidential. Client data is not used to train, fine-tune, or improve any underlying AI models, nor is it shared across customers or added to public or third-party datasets.

Clients retain full ownership of all submitted content. Upon termination of service, client data and the associated agent instance can be deleted upon request, ensuring no ongoing storage or access.

Answir follows security-by-design principles, including but not limited to:

• Logical isolation of customer instances;
• Secure API-based architecture;
• Least-privilege access controls; and
• Encrypted data transmission in transit.

Answir does not store end-user credentials, does not execute code on client systems, and does not initiate outbound actions beyond responding to user queries.

Answir integrates with multiple third-party data sources through a minimum of four secure, read-only APIs. These integrations enable Answir to retrieve up-to-date, verified information without requiring direct access to client systems or databases.

Depending on client configuration, these APIs may include:

• Regulatory filings and disclosure repositories;
• Stock data feeds; and
• Structured financial and reference datasets.

All API connections are access-controlled, encrypted in transit, and limited strictly to data retrieval. Answir does not modify, write to, or publish data back to any external system. This architecture ensures accuracy, timeliness, and system isolation while reducing operational and security risk.

Answir does not use client data, user interactions, or end‑user questions to train, fine‑tune, or improve any artificial intelligence or machine learning models. Each customer deployment is logically isolated.

No client data, prompts, responses, or interaction logs are shared across customers or reused for the benefit of any other client. Information provided to Answir remains confined to the specific client environment in which it is deployed and is used solely for the purpose of generating responses for that client.

To reduce operational, regulatory, and disclosure risk, Answir is intentionally designed with clear limitations. Specifically, Answir does not:

• Provide investment, trading, or financial advice;
• Make forward-looking statements or material disclosures beyond approved source content;
• Generate responses outside the client-approved knowledge base;
• Execute transactions or take autonomous actions on behalf of a company or user;
• Modify, publish, or file disclosures or regulatory documents; or
• Access internal systems, credentials, or non-public databases.

These constraints ensure Answir operates as an informational and engagement tool, not a decision-making or disclosure-authoring system.

Answir is designed for lightweight, low-risk deployment on client websites with minimal involvement from internal IT or web development teams.

Deployment typically involves embedding a small snippet of code or tag into the client’s website. This embed loads the Answir assistant securely from Cloudflare’s infrastructure and operates independently from the client’s hosting environment.

Key deployment characteristics include:

• No installation on client servers
• No changes to existing databases or backend systems
• No access to CMS, admin panels, or credentials
• No performance impact on core site functionality
• Easy removal or disabling at any time

Because Answir runs in isolation and communicates only through secure, read-only APIs, it does not expand the client’s attack surface or introduce operational dependencies. This approach allows companies to deploy Answir quickly while maintaining full control over their website, data, and disclosure processes.

Answir’s website, www.answir.ai, provides additional information on platform capabilities, use cases, and demonstrations. Answir automates the handling of routine investor questions through a compliant, AI-powered assistant trained on company-approved information. The platform helps companies improve response times, reduce repetitive inquiries, capture investor intelligence, and enhance overall engagement without introducing disclosure or compliance risk.