Sources & method

How answers are built

The assistant is instructed not to answer from general knowledge: every question is matched by semantic similarity (embeddings) against a base of indexed passages, and the model is instructed to answer only from the retrieved passages, citing them as [Source N]. If nothing relevant is found, it says so instead of guessing.

The knowledge base is built from three streams: original editorial content (guides, glossaries, checklists), written with artificial intelligence tools and published by Unleaf’s editorial team; an automated nightly collection, limited to the whitelisted official sources listed below; and editorial spin-offs (e.g. the CyberWatch digest), written with artificial intelligence tools and reviewed by the editorial team before publication.

Whitelisted official sources

Only these domains are collected automatically, and only as institutional content that can be reused on the terms stated by the source (see “Attribution & licences”); we do not collect paywalled content. Within each domain we collect only the categories of documents whose terms of reuse we have checked; where the licence has to be read on the individual document, we check it at the moment of collection.

Attribution & licences

Some sources require a specific attribution notice, shown next to the cited passage in chat and in the audit log:

• cert-agid.gov.it — Fonte: CERT-AGID — contenuto rielaborato, originale in licenza CC BY 4.0
• enisa.europa.eu — © European Union Agency for Cybersecurity (ENISA) — contenuto rielaborato
• nist.gov — Republished courtesy of the National Institute of Standards and Technology (NIST)
• attack.mitre.org — © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. Licence: MITRE ATT&CK® Terms of Use (attack.mitre.org/resources/legal-and-branding/terms-of-use/)
• protezionecivile.gov.it — Fonte: Dipartimento della Protezione Civile-Presidenza del Consiglio dei Ministri
• gov.uk — Contains public sector information licensed under the Open Government Licence v3.0
• edpb.europa.eu — © European Data Protection Board — contenuto rielaborato
• eur-lex.europa.eu — © Unione europea, 1998-2026 — fonte: EUR-Lex (eur-lex.europa.eu); contenuto rielaborato
• gazzettaufficiale.it — Fonte: Gazzetta Ufficiale — testo disponibile gratuitamente sul sito ufficiale; riproduzione non autentica

What we deliberately leave out

Sources cited but not collected. Some authoritative sources are not collected automatically: we use them only as references in our editorial content, in compliance with the conditions of each one. Today they are:

• acn.gov.it and csirt.gov.it — their legal notices require written authorisation to reproduce their content; until we have it, these sites remain references only.
• poliziadistato.it — content under a CC BY-NC-ND licence (non-commercial, no derivatives); for this reason we do not collect it.
• viaggiaresicuri.it — no open licence declared and a ban on “deep linking” in the site’s conditions: we cite it as a reference pointing to the homepage, with no direct links to internal pages.
• travel.state.gov — suspended since 6 August 2026: the site protects its pages with an anti-bot challenge, which as a matter of policy we do not circumvent. It will return to the whitelist only through ordinary access, an official API or feed, or an authorisation.

This list changes only with a documented decision: if a source enters or leaves the whitelist, this page is updated.

Every collection request respects the target site’s robots.txt, crawl-delay included, and a static list of disallowed paths. If a site has no robots.txt, only the static rules apply; if it has one that we cannot read (server error, access denied, anti-bot check, timeout), or if it asks for more than 15 seconds between requests, that site is skipped in that collection run.

The limits of this method

Grounding in sources reduces errors but does not eliminate them: the model can misunderstand a passage, combine several sources incorrectly or translate imprecisely. The assistant only knows what has been indexed: the absence of an answer does not mean that the information does not exist. That is why answers, as a rule, indicate their sources — the right way to use them is to check them — and are for information only, without replacing professional advice; and the quality of the answers is checked periodically on samples, with human review. How the system works, what it records and what responsibilities remain with those who use it is described in the transparency page on the AI assistant.