Every organisation deploying AI is deploying an artefact produced by someone else, from data they cannot inspect, by a process they cannot audit. That is uncomfortable and it is also the normal condition of every dependency you already ship.
All Trust & Security →
Start with the honest boundary, because a framework that promises more than it delivers is worse than none. For frontier-class models you cannot audit training data — open or closed, of any origin. A handful of fully open research models publish their data; none of the frontier models do. Anyone offering that assurance for a frontier model is describing something that does not exist. If your threat model genuinely requires provenance of training data, no current model satisfies it and the conversation is about whether to deploy at all.
What you can do is substantial and is what a defensible assessment consists of: pin a specific artefact and verify its hash; know who produced it and under what licence; test its behaviour against your own material including the cases you are worried about; control where it runs and what it can reach; and detect if any of that changes. That is a real assurance posture and it is typically achievable in a couple of weeks.
This usually arrives about models of Chinese origin and it deserves a structured answer rather than either dismissal or alarm. Separate it into three, because they have different answers.
Data transfer — closed completely by self-hosting. Weights are a file; they transmit nothing, and on an isolated network they could not — provided you also review any code shipped alongside them. This is the question people most often mean and the one most easily resolved.
Behaviour — testable on your own material, and workload-dependent. Every model from every jurisdiction has been aligned by someone with a view; the differences are measurable and for most business tasks immaterial. Test rather than assume, in either direction.
The artefact itself — partially assurable, as set out above, and no more or less so than for any other model. This is where the honest answer is uncomfortable and where it is identical regardless of origin.
And where an organisation has a standing policy on model origin, that policy is the answer. It is a governance decision owned by people who own the risk, and our job is to build within it rather than to argue against it.
Different risks, and for regulated organisations often lower overall. You take on verifying and operating the artefact; you remove a third-party processor from the data path entirely and gain the ability to pin a version indefinitely. Which trade is better depends on your risk register, and both are defensible.
Ask for it — some providers publish useful documentation of architecture, data sources and evaluations. Do not expect it to be complete or verifiable for any frontier-class model, and do not build a control that depends on it being so.
A short record per deployed model: version and hash, source, licence, behavioural tests run and their results, where it runs, what it can reach, and who approved it. Two pages, updated on change. It takes about an afternoon and it is what turns a defensible decision into an evidenced one.
A documented model assessment is what turns a defensible decision into an evidenced one. We produce it as part of the build.
30-minute technical call · no deck
What we built, what stage it is at, and a link to the live thing wherever there is one.
yourOS is an operating system with an AI at its heart. You talk to it like a person, out loud or typed. It makes your calls, plans your days and works on your projects with a crew of agents, on your own private server. Our own product, built from the first commit; the waitlist is open.
Website, backend and app assets for Sonora, a free AI sound-therapy app on iOS and Android published by Cognitive AI.
Brand, website, prototype, apps on five platforms, the AI backend and the algorithm-intelligence pipeline for Podswap, a social growth engine that runs without a human in the loop.
In closed beta: Roxy, a private AI assistant with permanent memory running on infrastructure the user owns. Brand, site, product, backend and conversational design.
Live at coherence.com: brand identity generated with AI agents we directed, the motion system and website for the group behind Sonora, AboutAI, WakeUp and MudShadows. Agent work remains in build.
Live at domainbooth.com for DomainBooth, a premium domain brokerage: a new animated mark, every page redesigned and rebuilt with designed mobile layouts, and a custom CMS for its sales record, featured names, press and enquiries.
Apps, platforms and campaigns for these teams, long before the AI work. Every one is written up on the work page — what we did, and where our part ended.
