In a shared office AI, who can see whose chats? Check five layers, because “private” can mean something different at each one.
Short answer. It depends on how the product is built and set up, not on the word “private”. A shared office AI has five layers of access: you, the people you choose to share with, team spaces such as shared document collections, administrators inside the app, and whoever runs the database, server and backups. In the self-hosted Open WebUI, for example, chats are visible to their owner and to anyone they are explicitly shared with. An administrator can open other users’ chats unless that switch is turned off, and the people who run the database still can. Get the answer for each layer in writing.
01
The five layers
Layer
Who
What they can usually see
What to ask
1. You
The account owner
Your own chats and files
Can I delete them? Can anyone restore them?
2. People you share with
Colleagues you pick
Only what you share, including shared chat links
Can a shared chat be passed on? Does a link need sign-in?
3. Team spaces
Members of a group
Shared document collections, assistants and prompts
Who can add, edit or delete? Is a collection private until shared?
4. App administrators
Staff with an admin role
Often every user’s chats, exports and settings
Can admin access to chats be switched off? Is each use logged?
5. Infrastructure operators
Whoever manages the database, server and backups
Everything stored, unless it is encrypted with keys they do not hold
Who holds the keys? Who can read backups?
02
A worked example: Open WebUI
Open WebUI’s documentation spells out its model. Regular users can read their own chats and chats explicitly shared with them. Every model, knowledge base, prompt and tool has an owner; with no grants, only the owner can use it, although administrators see it by default unless that bypass is switched off, and “public” means every signed-in user. Groups add access, and an admin-only Preview Access view lists what each user can reach.
On the administrator side, the setting that lets admins open other users’ chats is on by default as of October 2026. The documentation says that turning it off prevents casual access through the product, while operators of the database, host and unencrypted backups remain inside the trust boundary.
03
Documents need their own check
Chats are one risk. A bigger one is a shared document index that ignores who is allowed to read what. OWASP lists it as a weakness of retrieval-based systems: where groups share a vector database, content from one group can be returned to another unless access is partitioned. The UK government’s AI Playbook gives the rule in one line: make sure the AI model only has access to the data the user of the model should be able to access.
Test it. Ask a question from an account that should not see a restricted file and confirm the answer does not draw on it.
04
Defaults worth checking
Admin access to other users’ chats: on or off, and whether using it is logged.
Chat sharing and public links: who can create them.
Export: can an administrator export everyone’s chats in one action? In Open WebUI that is on by default.
Logs: what do they hold? Open WebUI advises metadata-only logging unless logging chat content is approved.
External model providers: prompts sent to a cloud model can be visible to that provider.
Separate trust boundaries: for HR or legal work, Open WebUI’s documentation suggests a separate instance with its own database and operators.
05
What ANVE says
ANVE is built for many named users. It logs every model call with the user, the app, the model and whether it ran locally or in the cloud. Cloud models are optional, added by an administrator, and their answers are labelled.
Roles today are administrator and user. Teams, finer roles and single sign-on are not on ANVE yet, and everything sits in one database on the box (see /security). What an administrator can read of another person’s chats or documents, how sharing works and how document access is partitioned are not stated here. ANVEAI confirms them in writing before a paid pilot.
06
Questions people ask
Does a “private” chat mean nobody else can read it?
No. It usually means other ordinary users cannot. Administrators, and the people who run the server and backups, may still be able to, depending on settings and encryption.
Can we keep one team’s chats away from the rest of the office?
In principle yes, with groups and per-collection access, or a separate instance for the most sensitive team. Test it with a real account from another team.
Is the model-call log the same as the chat history?
Not necessarily. A log can record who called which model without keeping the text. Ask what each log contains, because content in logs widens who can read it.
07
What is not real yet
No sealed ANVE unit exists; every image of the appliance on this site is a labelled render. The software runs today on a development machine. No customers yet, no certifications, no delivery date, and the final price is not announced.
Reservations are ₹999 in India or US$12 elsewhere, refundable in full until you confirm an order in writing (terms). Offices that cannot use cloud AI can apply to be one of ten design partners.
