Security and Architecture
How lowki.ai treats your data and your ERP
Written for the IT and procurement teams who have to sign off. Plain answers about how the product is built, so your team can judge it directly.
Data flow
What happens to a document
Five steps, from the email your team chooses to the record in Kinetic.
Your team drags an email into the lowki.ai folder. lowki.ai reads a copy of it and its attachments from your Microsoft Exchange Online mailbox through Microsoft Graph. The original never leaves your mailbox.
Each customer has its own Docker stack managed by lowki.ai, with its own lowki.ai instances and document converter, hosted in the UK. The copy is held in memory only while it's processed, then discarded.
The AI returns a fixed set of order or invoice fields, not free text, so what reaches Kinetic is always structured and predictable.
Records are created through Epicor Kinetic's own REST API, so your Method Directives, Data Directives and validations still apply. lowki.ai connects from one fixed IP address, so your IT team can allowlist it.
lowki.ai enters the order into Kinetic and flags anything it's unsure of for your team to check. We recommend holding new orders with a BPM in your own Kinetic work process, so every order is reviewed before it's processed. For AP, approval follows your Kinetic Company Configuration, and a person always does the posting, for both logged and AP invoices.
| Line | Part | Qty |
|---|---|---|
| 1 | BRK-2210 | 250 |
| 2 | BRK-2214 | 100 |
| 3 | FIX-0081 | 1,000 |
Illustration. Every order shows as entered by lowki.ai and links to its source email.
AI where it helps. A defined process everywhere else.
lowki.ai isn't an autonomous agent left to decide what to do. Most of it is ordinary, predictable software following a defined process. AI is used where it earns its place, such as reading an unstructured email or PDF, and what it returns goes through the same fixed steps into Kinetic every time.
Principles
How it's built
Your permissions still apply
lowki.ai doesn't change who can see what. A linked email opens from Kinetic only for people who already have rights to that mailbox in Exchange.
Your own Docker stack
Your lowki.ai instances, document converter and any other services you use run in a Docker stack that is yours alone, hosted in the UK. Those services are never shared with another customer.
No customer files at rest
Emails and attachments are read into memory, processed and discarded. lowki.ai doesn't store copies; the originals stay in your mailbox.
Tune it without code
lowki.ai reads Kinetic through the business objects and through BAQs we supply, which are faster. Your team can filter those BAQs to fine-tune what lowki.ai works with, with no code changes.
Traceable to source
Every order shows in Kinetic as entered by lowki.ai, and links back to the original email it came from.
EU AI processing
Document content is processed by Mistral AI in the EU, under Mistral's Data Processing Addendum. Your order and invoice data is processed to do the work and is never used to train AI models.
FAQs
Questions security teams ask
Where is our data processed?+
lowki.ai reads a copy of each email your team drags into its folder, through Microsoft Graph. The copy is processed in your own lowki.ai Docker stack, hosted in the UK, held in memory only while it's processed, then discarded; the original stays in your mailbox. Document content is read by Mistral AI in the EU, under Mistral's Data Processing Addendum.
Is our data used to train AI models?+
No. Your order and invoice data is processed to do the work and is never used to train AI models.
What access does lowki.ai need to Kinetic?+
Access to your Kinetic REST endpoints, like any integration, through an API key. lowki.ai connects from one fixed IP address, so your IT team can allowlist it. lowki.ai reads through the business objects and through BAQs we supply, which your team can filter. There's no extra Epicor licence to buy: lowki.ai uses a free licence held only for the duration of each transaction.
Who can see the linked emails, and what about retention policies?+
Access follows your existing Exchange Online permissions: only users with rights to the mailbox can open the linked email from Epicor, so Lowki.ai doesn't change who can see what. The link itself will become inaccessible if your retention policies delete the email or if it's migrated out of the mailbox, so it's worth aligning email retention to how long you want to be able to trace orders back to their source.
Does Lowki.ai post or pay invoices automatically?+
No. Lowki.ai does the entry and the matching. Approval of logged invoices follows your Kinetic Company Configuration, including who can authorise them and whether they're auto-approved, and a person always does the posting, for both logged AP invoices and AP invoice groups. lowki.ai never posts or pays.
How do we stop using lowki.ai?+
Revoke its API key. lowki.ai connects through that key and the BAQs we supply, so nothing else needs undoing. The orders and invoices it created stay in Kinetic like any other records.
Want to go through it in detail?
We're happy to walk your IT and information security team through the architecture and answer your security questionnaire.
Further reading
Built on Kinetic, not beside it
What lowki.ai uses in Kinetic instead of rebuilding it.
How to automate sales order entry in Epicor Kinetic
The four practical options, and what to check before you choose.
lowki.ai vs Epicor ECM Sales Order Automation
How the two approaches differ, and when to choose which.
