Ostendo “Minda” Gateway for AI Integration

In the very near future the new Ostendo Minda Gateway for AI integration will be released. It will provide a way of using AI with Ostendo in a safe and secure manner that will not expose your sensitive business data to the outside world and not compromise the integrity of your database.

We will release details as soon as they are available.

The Dangers of a DIY Approach

We are warning our clients to exercise extreme caution with AI as the growing popularity of "vibe coding" and artificial intelligence integrations creates new operational and cybersecurity risks, particularly for organisations running mission-critical ERP systems such as Ostendo.

Industry consultants are reporting a rise in businesses experimenting with AI-generated software, custom business intelligence solutions, and automated integrations that does not use the governance, testing, and security controls typically associated with traditional software development.

While AI tools have dramatically reduced the barriers to creating software, experts warn that the same tools can introduce significant risks when connected directly to live business systems.

The Rise of "Vibe Coding"

The term "vibe coding" describes a development approach in which users rely heavily on artificial intelligence to generate software solutions, often with minimal technical understanding of the resulting code.

Supporters argue that vibe coding enables rapid innovation and allows non-programmers to create useful tools in a fraction of the time previously required. However, critics warn that many AI-generated applications are deployed without proper design reviews, documentation, testing, or security assessments.

The concern is that users often assume the generated code is correct, secure, and suitable for production environments simply because it appears to work.

Security experts point out that AI-generated applications can contain:

• Undiscovered software bugs.
• Authentication weaknesses.
• Poor error handling.
• Insecure database access methods.
• Exposure of proprietary business information.
• Hidden compliance and privacy issues.

In many cases, these problems remain undetected until they cause operational disruptions or data breaches.

Particular Risks for ERP Environments

The risks become substantially greater when AI-generated software interacts with Enterprise Resource Planning (ERP) systems such as Ostendo.

ERP platforms contain some of an organisation's most valuable information, including:

• Customer records.
• Supplier information.
• Financial transactions.
• Inventory data.
• Purchase orders.
• Pricing structures.
• Manufacturing records.
• Employee information.

Any software granted access to such systems effectively gains access to the operational heartbeat of the business.

We have recently noticed a growing interest in connecting AI platforms directly to Ostendo using the Ostendo API or through emerging technologies such as MCP servers. These present serious security risks for your data and the integrity of your database, especially when developed by people with minimal technical understanding of the resulting code.

API Access Creates Security Risks

The Ostendo API is designed to allow authorised systems to exchange information with the ERP platform. When configured correctly, it can support legitimate integrations with reporting tools, customer portals, and other business systems.

Problems arise when AI-generated applications are provided with unrestricted API credentials. Accessing the Ostendo database through an AI service requires the disclosure of database credentials or Ostendo user credentials to that service, thereby granting it authority to modify business records. This introduces security, privacy, data integrity, and compliance risks.

Poorly designed integrations may:

• Retrieve excessive amounts of sensitive data.
• Modify records unintentionally.
• Create inaccurate transactions.
• Circumvent established approval processes.
• Expose confidential information to external AI providers.
• Generate unauthorised updates in live production databases.

MCP Servers Introduce Additional Concerns

Interest is also growing in the use of MCP (Model Context Protocol) servers, which are designed to allow AI assistants to interact with external systems in a structured manner.

When connected to an ERP database, an MCP server may allow an AI system to query records, retrieve business information, or execute actions through approved interfaces.

However MCP-based integrations introduce a unique challenge, as users may grant an AI system broad access without fully understanding the consequences.

A seemingly harmless request such as "Show me all customer accounts with overdue balances" may require access to sensitive financial information.

Likewise, a request such as "Correct all inventory discrepancies" may trigger large-scale modifications to operational records.

Without carefully enforced permissions and audit controls, AI systems may perform actions far beyond what individual users intended.

Data Privacy and Compliance Risks

Another major concern involves the handling of business data outside the organisation's control. Many AI services process information through cloud-based infrastructure operated by third-party providers. 

Most consumer AI platforms do not guarantee that data submitted during a session remains confined to that session. Their terms of service typically reserve rights to process inputs and outputs for purposes such as operating the service, improving functionality, training models, performing safety reviews, and, in some cases, sharing content with service providers or third parties involved in delivering the service.

This is particularly relevant when using AI for "vibe coding", where users often paste source code, configuration files, support tickets, customer information, business data, or even sensitive credentials and secrets into AI tools. Once that information is submitted, the handling of the data is governed by the AI provider's published terms and policies, not by the user's expectations or intentions. As a result, organisations should carefully consider the privacy, security, and confidentiality implications before sharing proprietary or sensitive information with consumer AI services.

If sensitive ERP information is transmitted to external services, businesses may face obligations relating to:

• Privacy legislation.
• Contractual confidentiality requirements.
• Data residency obligations.
• Industry regulations.
• Customer data protection commitments.

Even when an AI provider offers strong security measures, organisations remain responsible for ensuring that confidential information is handled appropriately.

No Support for AI “Vibe Coding” or AI Integrations

Because of these risks, Ibis Business Intelligence Solutions will not provide support for any code written in whole or part by AI tools or systems.

We also do not support any direct AI integration to the Ostendo database through the Ostendo API or an MCP Server, or any other integration to the Ostendo database that is not developed by our team of expert developers.

To learn more about why we have taken this position, just type the following prompt into your AI system

Why many ERP software vendors do not support end user vibe coding or self integrating AI using an API or MCP server