The most useful data is the data you can't risk
Account numbers, financial statements, loss histories, participant census files, health details on a benefits account, share valuations. This is exactly the information that would make AI useful at your firm, and exactly what your policies, your clients' contracts and your regulators care most about.
So firms either ban AI and watch staff use consumer tools anyway, or allow it without knowing where the data goes. Neither holds up well in an exam or a client due-diligence questionnaire.
- Staff use consumer AI tools because nothing approved exists
- Vendor due-diligence and client security questionnaires ask where data goes
- Some contracts or policies prohibit sending data to third-party models
- IT and compliance can't see what's being shared
What we build
Enterprise AI with the right terms
Enterprise AI plans with single sign-on and per-role access, connected to your systems with least-privilege access. Enterprise plans from Anthropic don't train models on your business data under their commercial terms. Source data stays in your tenant wherever possible.
Self-hosted and open-weight models
For data that can't go to a hosted provider, we deploy open-weight models on infrastructure you control. We've done this R&D for clients with government and federal data constraints.
Data scoping and access controls
Before connecting anything, we define what the AI can read, what it can write and what it can never touch, down to the folder, field or record type.
Hybrid routing
Send routine, non-sensitive work to a hosted model and keep sensitive work on a private one, with rules your IT and compliance teams approve.
How it works
Step 1: Classify the data and the use cases
We sort your use cases by the sensitivity of the data they need, working from your existing data classification and your compliance team's rules.
Step 2: Choose the deployment model
For each use case we recommend enterprise hosted, self-hosted or hybrid, with the trade-offs in cost, capability and control written out plainly.
Step 3: Build with least privilege
We connect to your systems with scoped credentials, keep data in your tenant wherever possible, and log access so IT and compliance can review it.
Step 4: Operate and review
We monitor usage and access, update models and controls, and give you what you need to answer client and vendor due-diligence questions accurately.
Systems we connect
- Microsoft 365, Entra ID and SharePoint
- Google Workspace
- Salesforce- and HubSpot-class CRMs, including wealth-management CRMs
- Your agency management system (AMS), scoped during Discovery
- Your own cloud or on-premise infrastructure for self-hosted models
Related work
Registered investment adviser: compliance-aware deployment planning
We planned an AI deployment for an RIA that defined which data could reach the model, what would be logged and retained, and how review would work.
Self-hosted model R&D for restricted data
We've built and tested self-hosted, open-weight model setups for clients whose data can't go to a hosted provider, including government and federal work. The same approach applies to financial and insurance data with strict handling rules.
Questions IT and compliance ask
Is a self-hosted model as capable as a hosted one?
Usually not for the hardest tasks. For extraction, summarization and classification on well-defined documents, a self-hosted model is often good enough. We test on your files and tell you where the gap is.
Does our data train the AI provider's models?
Enterprise plans from Anthropic don't train models on your business data under their commercial terms. We'll walk your team through the specific terms, and self-hosted models don't send data to a provider at all.
Can you help us answer client security questionnaires?
We document how each deployment handles data so your team can answer accurately. We don't sign questionnaires on your behalf or claim certifications we don't hold.