Skip to content
Xalerate

HOW IT WORKS/TECHNICAL OVERVIEW

How Xalerate works.

One place where your people work with AI: shared Spaces, your company's memory, and one governed Gateway to every model. Every answer comes from what you may see, every call follows your rules, and everything that matters is written down.

Where it fits

01 / WHERE XALERATE FITS

Between your people, your applications
and the models they use.

Your people work in the Client; your applications call the API. Both reach models only through the Gateway. What your company saves stays in Spaces and Memory, and each part does one job.

YOUR ENVIRONMENT

Your peopleuse the Client
Your applications and agentscall the API

XALERATE

Sign-inWho you are, and your memberships
ClientShows; keeps no copy of anyone's data
Spaces and MemoryChats, files and saved knowledge, per Spacestored
GatewayCarries every model callpasses through

AI MODELS

Models your organisation allowson the tiers your settings permit
Stored in XaleratePasses throughEvery model call, from the Client or your applications, goes through the Gateway.

02 / GETTING STARTED

Start with what you have.

Give your people the Client, connect an existing application to the Gateway, or both. Either way, your organisation first accepts the Terms and the Data Processing Agreement and chooses a residency floor.

Use the Xalerate Client

People join your organisation by invitation and sign in with a one-time code sent to their email; they may add a passkey. There are no passwords.

You configure

  • Who is invited, and to which Spaces
  • Who can see each Space's memory
  • Which models your organisation allows

Connect an existing application

Your application calls the Gateway's OpenAI-compatible API with a project key, and names the person, agent or system each request is for.

You configure

  • A project and its key, for production or staging
  • How much the actor's identity proves: asserted or verified
  • Masking, the rate limit and the spending caps
Example request · from the current API reference
curl https://api.xalerate.ai/v1/chat/completions \
  -H "Authorization: Bearer $XALERATE_API_KEY" \
  -H "X-User-Id: alice@example.com" \
  -d '{"model": "auto", "messages": [{"role": "user", "content": "Hello"}]}'

Check the API reference for supported endpoints, parameters and streaming. In this example the application asserts the user; verified identity uses a token from our sign-in service instead. Keep keys on your server.

03 / YOUR BOUNDARIES

You set the rules.
The platform checks them.

Xalerate checks requests and access against the configuration in the platform. It applies the settings you make there, not rules it has not been given.

You configureWhat is checked
Invitations and membershipsAccess comes from membership. When a membership ends, access to Memory ends at once and every other access within ten minutes.
Who can see each SpaceEvery way of reaching a file or a memory checks, at that moment, that the person may see its Space.
A residency floor, chosen onceA project, a person or a request may be stricter, not looser. A request is never served below your floor.
Masking, per projectDetected personal data is replaced by tokens before anything leaves the Gateway.
Rate limit and spending capsSixty requests a minute by default, configurable; daily and monthly caps in euros. Both fail closed.

When a request does not meet your settings.

It is refused, and the refusal is recorded. If you named a model that is not eligible at your tier, the refusal lists the models that are. If you let the Gateway choose and nothing is eligible, the refusal says so. A looser tier is never substituted silently.

04 / FOLLOW A REQUEST

One request, through the Gateway.

The same checks run on every call, in the same order. A call cannot reach a model any other way.

FROM

Your application
or the Client
Gateway checks
Key and environmentActorTermsRate limit and capsResidency floor and tierMasking

Each check can refuse the request.

TO

A model on an eligible tier

Response back through the Gateway: masked values restored, the record completed, X-Request-Id and the cost returned.

What can stop it

Any of the checks. Also: a record that cannot be begun, or a masking detector that cannot be reached while masking is on. Nothing is forwarded.

What you get back

A structured refusal that says what happened and what to do next, never a quiet default or a result that looks like success.

What is recorded

One record per request, refusals included, begun before the provider is called and completed with the model and provider that ran, tokens, latency, cost and status.

05 / COMPANY KNOWLEDGE

Company knowledge,
with clear access.

Knowledge lives in Spaces. Each Space has members and one setting for who can see its memory: Members only, the default, or Everyone at your organisation. Every person also has a Personal Space.

YOUR ORGANISATION · NORDFIN

Emma searches from a chat in Customer support
Customer supportMembers only · Emma is a member
chat
Delayed delivery to Malmö
file
Returns policy.pdf
memory
Decision: replacements ship by express

Reached by the search

Company policiesEveryone at Nordfin
chat
Can I book a train abroad?
file
Employee handbook.pdf
memory
Fact: expenses are filed monthly

Reached by the search

PersonalOnly Emma
chat
Draft reply to a customer
file
My notes.docx
memory
Preference: answers in Swedish

Reached by the search

LeadershipMembers only · Emma is not a member
chat
Board meeting prep
file
Hiring plan.xlsx
memory
Decision: pause new hires

Not a member: not reached

Outside Nordfin

cannot reach in
Every file and every memory belongs to one Space, and every way in checks that Space.

How knowledge gets in

Files added to a Space become searchable: text-based PDF, Word, and CSV or Excel. Each file shows its state, and anything unsupported is marked as such.

Using is not saving

A chat can use what a person may see. It becomes lasting knowledge only when a person saves it, and the button names where: Save to <Space>.

Search follows access

Search covers the Spaces a person may see, and access is decided before anything is ranked or reaches a model. Each result names its Space.

06 / EVALUATE

Evaluate Xalerate
for your environment.

Bring your architecture to a technical walkthrough, and we'll work through the fit against your own constraints.

Data & deployment
Required regions, infrastructure operators and data retention.

Identity & integration
Your applications, identity provider and actor verification.

Operations
Latency requirements, availability, limits and failure handling.

Evidence & oversight
Audit access, exports and the documentation your security team needs.

Book a technical demoRead the API reference ↗SecurityTrust center