What runs where, and who holds the keys.
The page a compliance person, a managing partner or an auditor gets forwarded.
How I work
I run open-weight models on my own hardware day to day, alongside workflow automation, an ERP, and coding agents that build and maintain the tools I use. A frontier model only sees a task when the work needs that level of reasoning, and even then it goes out through an API on my own account, with only the minimum approved context for that task sent, never the client's full underlying dataset. I install and maintain every piece of it myself.
Processed locally by default
Anything with a patient, a client file, a financial record or a cost book in it. Transcription, intake, records search, drafting over your own data, internal chat.
Frontier model, only under a written rule
Marketing copy, public content, code with no secrets, analysis on data with the names stripped out. On your key, on your account.
Who owns what
You own the hardware, the accounts and the workflows. You control the installed model weights and configuration, subject to their licenses. If you fire me you keep all of it. In writing.
What I do and do not touch
I do not keep your data on my systems. When I maintain the box I log what I accessed.
The security floor on every install
- Multi factor
- Least privilege
- Credentials in your name
- A secrets vault
- Audit logs
- Separate development and production credentials
- No keys in shared docs or workflow screenshots
Data minimization
I do not push your whole inbox into a model when one field will do.
Human review
One named person on your staff owns final review of anything the AI writes that touches money, patients, legal filings, hiring or a customer.
If you are in California
During the audit we identify which California privacy, employment, recording, messaging and automated-decision requirements apply to the workflows we are considering. That covers bot disclosure for any consumer-facing voice or chat, consent and opt out on automated texts, and whether the CCPA thresholds reach you.
Who this is for
Trades and home services get their own page too.
If your auditor wants this as a PDF with your name on it, that is the architecture statement, and it comes with the install as a contract exhibit.