AI assistant for technical demos and security questions

A demo is going well until somebody asks what happens to data in transit between regions, whether you support customer-managed encryption keys, what your rate limits actually are under load, or which subprocessors touch their data.

These answers exist in your organisation. They are in the architecture doc, the SOC 2 addendum, the API reference, the subprocessor list. The problem is that you are presenting, the document is three windows away, and the person asking will notice you looking for it.

In most conversations, an approximate answer is recoverable. In a security review it is not. The engineer takes a note. That note becomes a line in a questionnaire. The line becomes a clause your legal team then has to argue out of a contract, and someone asks why the rep said something different on the call.

A general-purpose AI assistant makes this worse rather than better. It will produce a confident, well-structured, entirely invented answer about your key management, because that is what such models do when they lack the specific fact.

Blackbox answers only from the documents you uploaded. If your whitepaper says keys are managed in AWS KMS with annual rotation, that is what appears. If nothing in the vault covers the question, the absence is itself a signal — follow up rather than invent.

This is the use case where overlay behaviour stops being a detail. A technical demo is your screen, almost end to end: the product, the console, the architecture diagram, the logs.

Anything drawn on top of your screen is in the stream the other side receives, unless it is built not to be. Blackbox excludes its overlay from screen capture at the OS level on macOS and Windows. You read the answer about key rotation; they see the console you are demoing.

And nothing joins the meeting, which matters on this particular call type — a security-conscious customer asking why an unfamiliar participant is in the room is not the opening you want to a trust conversation.

Architecture and data-flow documentation. The security whitepaper. SOC 2 Type II or ISO 27001 reports and any addenda. The subprocessor list. Data residency and retention policies. The API reference with real rate limits. Your incident response and escalation procedure.

Add the internal known-limitations list as well. The instinct is to leave it out, but it is the most valuable document in the set: it turns the worst moment on the call — a gap in the product — into a clear, fast, credible answer rather than a visible improvisation.

The assistant retrieves. It does not decide what is safe to promise, when to escalate, or whether a requirement is a dealbreaker. If a question needs engineering judgement rather than a documented fact, saying so is still the right answer, and saying it quickly is still better than filling the gap with something that sounds right.