Montreal’s Maya HTT says its new engineering assistant keeps every drawing inside your walls. For a defence supplier, the harder question is which employee gets to read the answer.
Your shared drive already follows one plain rule: if you cannot open the folder, search will not show you the file. An on-premises AI assistant works differently. It reads the whole library ahead of time so it can answer in seconds, and whether it still honours that folder rule is a setting you have to check yourself.
That matters this week because Maya HTT launched M-Bot on November 2, an on-premises AI assistant that answers engineering questions from Teamcenter, SharePoint and Confluence. The launch materials promise local hosting and fixed costs. Neither the release nor the product page, as we read them on November 2, says how answers are limited to what each user is already cleared to see.
Key points
What did Maya HTT actually ship?
M-Bot is a retrieval assistant: it indexes a company’s own engineering files, then answers plain-language questions with links back to the source documents. Maya HTT says it runs on premises or in customer-controlled infrastructure, connects to Teamcenter, SharePoint and Confluence, and carries no token metering. Maya HTT says buyers can book a demonstration now.
The November 2 release pitches it at aerospace, defence and manufacturing teams that hold sensitive intellectual property. The M-Bot product page goes further: no cloud calls, no external APIs, works without wifi, air-gap compatible, and the customer owns both the embeddings and the knowledge base. Those are real design choices, and for a shop that cannot send drawings to a US cloud they remove the first objection.
One term is worth defining. Embeddings are the numeric fingerprints the assistant builds from each document so it can find relevant passages quickly. Owning them means the index stays yours. It says nothing about who may query it.
Why does an on-premises AI assistant raise a controlled goods question?
An on-premises AI assistant raises a controlled goods question because it can summarize protected technical data for anyone who types a question. Canada’s Controlled Goods Program treats blueprints and specifications, on paper or electronic, as controlled, and defines transfer as disclosing content in any manner. A tidy paragraph pulled from a drawing is still disclosure.
Public Services and Procurement Canada says the program covers more than 4,000 registrants that handle controlled goods, and that a breach of the Defence Production Act can bring a fine of up to $2,000,000, prison of up to 10 years, or both. Its registration page defines “examine” as considering something in detail to discover its essential features. Asking a bot how a bracket was qualified fits that description comfortably.
The Controlled Goods Regulations also expect a written security plan setting out how a registered firm controls examination, possession and transfer, plus a report to the Minister within three days of an actual or potential breach. An assistant that pulls from every folder sits squarely inside that plan, whether or not anyone wrote it in.
The M-Bot page names ITAR and EAR, the US export regimes. It does not mention the Canadian program. That may simply reflect who the page was written for. Even so, a Canadian buyer should not assume the US wording covers the Canadian duty.
Is the 60x speed claim the number to check first?
The 60x speed claim is not the number to check first, because speed only helps once access is right. Maya HTT says a five-minute manual search drops to about five seconds, which is where 60x comes from (300 seconds divided by 5). The release gives no test set, document count or method, so treat it as a vendor claim.
Speed is also the easiest thing for your own team to measure later. Access mistakes are harder to spot, because a wrong answer to the wrong person looks exactly like a right answer to the right person. Nobody complains about the bot being helpful.
Fixed costs deserve a fair hearing too. Costs known up front, with no per-question meter, suit a plant where engineers might ask many questions a shift. The release says costs are known up front but publishes no price, so we cannot compare it with metered cloud tools here. If you want that comparison, our earlier look at what a self-hosted AI model does on your network covers the other half of the local hosting argument.
What we read, and what we could not test
We read the Maya HTT release, the product page and the federal program pages on November 2. We have not run M-Bot, seen its admin console or spoken with a customer. So we cannot say whether it trims answers to each user’s existing folder rights. It may well do this. The public material simply does not say.
So the access question stays open in this column. Closing it is cheap: ask for a demonstration on your own files and watch what happens under two different logins.
A clearance test with two logins and 20 questions
A clearance test with two logins and 20 questions is the quickest way to find out whether an on-premises AI assistant respects controlled goods rules. Run it during the vendor demonstration, before any purchase order, with your designated official in the room. It takes about half a day and needs no new software.
Text summary: the checklist above asks a buyer to compare a cleared and an uncleared login on 20 real questions, accept only zero leakage from controlled folders, confirm query logs exist, and confirm that revoked access takes effect promptly.
If the uncleared account gets even one answer from a controlled drawing, stop. That is a configuration question for the vendor and a security plan question for your designated official, in that order. Our look at the rogue Claude Code add-on that reached Cursor users made a similar point about developer tools: the default setting decides the outcome more often than the feature list does.
Who should run this test?
Any Canadian manufacturer registered in the Controlled Goods Program, or bidding on work that needs registration, should run this test before adopting any engineering chatbot. It matters most where controlled and commercial work share one file server, because an assistant indexes them together unless someone separates them first.
Firms with no controlled work still gain from the same check. Pricing files, customer drawings and HR folders carry their own rules, and the question of who sees which answer applies just as much. If your team is weighing where data lives at all, our explainer on where Canadian data has to live when AI touches it sets out the residency side, and the Canadian AI companies hub tracks other domestic vendors.
Our view is simple. M-Bot’s local hosting is a genuine advantage for Canadian engineering firms, and a Montreal vendor building for that market deserves a serious look. Judge it on whether the uncleared login comes back empty, and ask to see that before you ask how fast it is.
FAQ
Does an on-premises AI assistant meet Controlled Goods Program rules by itself?
No. Hosting on your own servers settles where data sits. The program also governs who may examine controlled technical data, and it defines transfer as disclosing content in any manner, so answers must be limited to cleared users.
What is Maya HTT’s M-Bot?
M-Bot is an engineering knowledge assistant from Montreal-based Maya HTT, launched November 2, 2026. It indexes a company’s own files, including Teamcenter, SharePoint and Confluence, runs on premises or in a private cloud, and answers questions with links to source documents.
Is the 60x faster claim for M-Bot independently tested?
We found no independent test. Maya HTT says a five-minute search drops to about five seconds. The release gives no test set or method, so treat it as a vendor claim and time your own searches during a demonstration.
How do I test whether an AI assistant respects folder permissions?
Ask 20 real questions from two accounts, one cleared and one not. The uncleared account should get nothing from controlled folders, and every citation it sees should open a file it could already open. Then revoke one folder and ask again.
Facts checked November 2, 2026 against the Maya HTT release and product page, Public Services and Procurement Canada’s Controlled Goods Program pages and the Controlled Goods Regulations. We have not tested M-Bot.
