Anything we leave vague here, you would find later, at a worse moment, with less goodwill.
Every other page on this site states what is true. This one states what is not. It is not a legal hedge and it is not modesty. A claim you can check is worth more than a claim that sounds bigger, and the only way to be checkable is to draw the edge yourself.
The first set of limits is about evidence of the ordinary commercial kind. We are a young practice and we have not accumulated the artifacts that make a vendor comfortable to buy, so here they are, absent, in one place.
What stands in their place is evidence you can check yourself: a controls matrix with verdicts, a deployment in an account you own, and the standing exceptions rendered to you inside the product.
No audit firm has examined our controls and issued an opinion. There is no SOC 2 report and no ISO/IEC 27001 certificate. What exists instead is a controls matrix with verdicts and the standing exceptions shown to you in the product.
No client names, no logos, no outcome percentages, no testimonials. Any figure we published would be unverifiable by you, and the clients whose results would be worth reading did not sign up to be marketing.
One principal with a small bench of contractors. The capacity comes from the platform and the deployment factory, not from headcount. It is a real risk to weigh, which is why runbooks and infrastructure as code are contractual deliverables and the exit path is written before the engagement rather than after it.
We hold no third-party test report and will not imply one exists. The deployment sits in an account you own, so a test is yours to commission under your provider's testing policy, and we will scope it with you and fix what it finds.
This is the limit most often blurred in this market, usually by people who know better. Getting it right is the difference between a claim your security reviewer accepts and one they stop reading at.
A record that is described loosely is worse than no record, because somebody will rely on it in an investigation. These three are the ones most often overstated in AI governance material.
The model invocation log carries model, caller identity, latency and token counts, and deliberately no content. So we never write that every prompt and response is auditable. It is evidence of use and attribution, which is a different and more defensible thing.
Everything loaded into a deployment's knowledge base is readable by every user of that deployment. There is no query-time permission filter, no permission labels at ingest, and no groundedness score. The control today is what you choose to load, which is stated on the page that describes the feature as well as here.
The content policy engine supports denied topics and rules for personal information. Both are configured per client and are empty by default. We therefore promise no redaction and no prompt-injection defence as an outcome. The policy is mandatory; what it contains is your decision.
We publish no availability number, no response-time commitment, no latency figure and no time-to-deploy figure, for one reason: we have not measured any of them to a standard we would defend in front of a reviewer. There is no timer in the deployment factory and no service-level objective anywhere. Rather than borrow a plausible number, we leave the space empty.
The same discipline applies to operations. What exists is deliberate: releases rolled one deployment at a time and confirmed, drift and diff checks before changes, acceptance scripts run against the live deployment over HTTPS, a dated operations journal, and a direct line to the person who built it. What does not exist, and is therefore not sold to you: an error budget, an on-call rotation, an incident severity classification and a paging configuration.
Baseline is the low-cost entry posture. It has no private networking and no account-level audit trail, and encryption at rest uses provider-owned keys. It suits low-sensitivity use and a first evaluation. A security review will usually want Standard, and we will tell you that before you buy rather than after the questionnaire comes back. See posture tiers.
The claims in the left-hand column are the boilerplate of this market. Each one is corrected against what is actually true of a deployment, with the page that carries the detail.
| What you may have read elsewhere | What is actually true here | Read more |
|---|---|---|
| "The AI runs inside your network." | A managed model service cannot run in your network. Your compute, storage, identity and policy are in an account you own; the model is reached as a service. | Architecture |
| "Your data never leaves your security boundary." | Data at rest stays in your account. The content of an inference call is processed by the managed model service. | The boundary |
| "Your data never leaves Canada." | Residency is configurable and pinned to your region when you need it. Under the pin, every current frontier model has no route and is refused in words rather than rerouted. | Residency |
| "Every prompt and response is auditable." | The invocation log deliberately carries no prompt or answer text. It records model, caller, latency and token counts. | Administration |
| "Built-in redaction of personal information and defence against prompt injection." | The policy engine supports denied topics and personal-information rules. They are configured per client and empty by default. | In policy |
| "Tunnelled into your office network." | The platform lives in a cloud account you own and your people reach it by signing in. No VPN, tunnel or reverse proxy into an office network is part of it. | Architecture |
| "Priced per seat." | No seat concept exists in any of our systems. You are not buying seats, you are buying a private AI platform on your own cloud, yours to keep. | Pricing |
| "Deployed in days." | Deployment time has never been measured. No timer, duration or manual-step count exists in the factory, so no figure is published. | Deployment |
| "SOC 2 ready", "audit ready." | We hold no third-party attestation. We provide technical controls designed to align with SOC 2 Trust Services Criteria and ISO/IEC 27001:2022 Annex A, each with a verdict. | Compliance |
The rule we work to: exact claims beat broad claims, and region, model, retention, networking and provider behaviour all have to be specified before a sentence about them is true.
A broad claim protects the seller. An exact claim protects the buyer, because it is the only kind you can carry into a room and answer for. When your board asks whether the AI environment is under control, "it is private and secure" gets you nothing. "Inference cannot happen without the content policy, it is confined to these regions, the knowledge base has no per-document permissions so we load only what everyone may see, and here is the list of what is not closed" ends the conversation properly.
It's not a black box. You can see how it's set up, and that's exactly what lets you answer for it.Why the limits are published next to the claims
Some, and it ends the wrong ones early, which a practice this size cannot afford to do slowly. The buyers we want are the ones who read this page and recognise the register, because it is the same register we will use during an incident.
Yes, by deletion. When something here becomes true it moves to the page that describes it, and this page loses a line. What we will not do is pre-announce: if a capability is not built, it does not appear on this site at all, including as a roadmap item.
The account, the identity directory, the data at rest, the knowledge index, the roles and grants, the audit records, the encryption keys at the higher tiers, and the policy that every inference call must carry. Most "private AI" means a vendor holds your data privately. Ours means you hold it.
The honest way to say the rest: the content of a model call is processed by the managed model service, under your account's retention election, and by default prompts are not used to train models and are not shared with model vendors.
No. It is a different product with a different shape: a private server in a cloud account you own, giving the assistant your people already use governed access to your documents. It runs no language model, and tool results travel to that assistant's vendor, which is its own boundary question. Its limits are set out at gateway limits.
Bring the hardest item on this page to the assessment and we will tell you whether it is a blocker for you or not.