Where does the data physically go?
Your device, your infrastructure, a named provider’s tenant — stated plainly, per tool.
The data answer
Before we recommend a single tool, we tell you where your data goes.
The market’s real objection to AI is no longer whether it works. It is custody. This is how we answer it — first, and in writing.
01 Every prescription answers three questions
A data posture is attached to the recommendation itself — not filed in an appendix nobody reads.
Who — or what — can see it?
Which people and which models touch it, and whether your inputs can be used to train anything.
What did we rule out, and why?
The tools we rejected on data grounds alone, named — so you see the discipline, not just the picks.
02 The posture, in practice
Every tool lands in one of three places.
The same discipline runs through every prescription in the Audit Deck. Approved tools carry their controls; ruled-out tools carry the reason.
Prescription Data posture Verdict
On your infrastructure Self-hosted or on-device. The data never leaves your control. Approved
Enterprise tenant Isolated tenancy, no training on your inputs, residency and controls in the contract. Approved
Public or consumer tool Inputs used to train the model, or residency we could not verify. Ruled out
Illustrative postures. Yours are specific to your tools, your jurisdiction, and your matters — and named, not generalised.
03 Where the discipline comes from
This is not a policy we adopted. It comes from fifteen years handling confidential matters at the highest professional level — where the cost of data going the wrong way was measured in careers and cases.
04 And it never speaks for you
Custody is one half of trust. The other is that judgment stays human.
A tool can be perfectly safe with your data and still say the wrong thing to your client. So the doctrine holds on both sides: AI drafts, a human decides, a human sends. Nothing reaches the people you answer to without a person choosing to send it.
05 Proof
The record, kept the same way every time.
When an engagement rebuilds a workflow, it is logged in one shape — the hours it took by hand, the calls it took to rebuild, and where the human checkpoint now sits. The first entries are being written. We would rather show you an empty ledger than a borrowed one.
Case 01 Forthcoming
{process} ran {X} hours a month by hand.
Rebuilt in {n} calls.
Now {Y} minutes — and a human checkpoint.
Case 02 Forthcoming
{process} ran {X} hours a month by hand.
Rebuilt in {n} calls.
Now {Y} minutes — and a human checkpoint.
Case 03 Forthcoming
{process} ran {X} hours a month by hand.
Rebuilt in {n} calls.
Now {Y} minutes — and a human checkpoint.
Start with one workflow.
Bring the one that worries you most. On the diagnostic call we will examine it, find the bottleneck, and prescribe one fix — with its data posture, live.