AI security review.
Getting through it.

These options can be contracted, and we configure and verify them. At the time of writing, hosted model providers offer enterprise endpoints with no training on inputs and, on some tiers, zero-retention configurations; availability varies by provider, model and tier, and several retain inputs for a period for abuse monitoring unless a specific agreement is in place. We record the exact retention and training terms in the architecture document and verify the configuration against them. The terms themselves are between you and the provider — confirm them against the provider's current contract. Where that contractual position is not sufficient for your risk appetite, the alternative is open-weight models on infrastructure you control, where the question does not arise.

As an authorisation problem rather than a filtering one. Content retrieved from documents, emails or web pages is treated as untrusted data, never as instructions. Tools are scoped to the minimum permission needed and the destructive ones require confirmation. Filtering helps at the margins but cannot be the primary control, because the attack surface is the entire content of everything the system reads.

Wherever your requirements dictate. For EU data residency we deploy in EU regions and select model endpoints in EU regions, or run open-weight models entirely inside your perimeter. The residency requirement is captured in discovery because it constrains the model choice, and discovering it late means rework.

Deleted on your schedule, with written confirmation. Where systems run in your own infrastructure the question is largely moot — we never held the data. Access credentials are revoked at handover and we ask you to verify the revocation rather than taking our word for it.