When your platform handles data from different business units, clients, or regulated domains, you need more than encryption — you need structural isolation. In Kili, each project is an isolated unit: its own assets, its own team members, its own permissions. Users only see the projects they're assigned to. Cloud storage integrations can be restricted to specific projects, ensuring that data from one workstream never leaks into another. Role-based access operates at both the organization level (who's in the org, what's their role) and the project level (who can access this specific project, and what can they do). Encryption at rest and in transit is standard. Audit trails track team activity and data handling across projects.

Some projects run on Kili's managed cloud. Others need to stay within your infrastructure. Some require air-gapped environments with no external connectivity. Kili supports all three scenarios — SaaS, Azure Marketplace, and full on-premise deployment on Kubernetes — with the same core annotation tools, quality workflows, and API regardless of where it runs. For operations that span multiple security tiers, this means you can segment projects by sensitivity level without fragmenting your tooling or retraining your workforce.