Security & data
Where your information actually goes.
Different services handle data differently, and a vendor who tells you "your data never leaves your building" about everything is telling you something that isn't true. Here's the honest version, per service.
By service, specifically
| Service | Where it runs | What's stored |
|---|---|---|
| Website assistant public info only |
Cloud, at the edge | Nothing |
| Intake assistant | Cloud | Only what the visitor submits, into your existing form or inbox |
| Managed AI workspace | Cloud, third-party platform | Your prompts and files, on the platform's infrastructure |
| Internal tool / custom app | Your choice | Your data, in a database you own |
| On-premises AI | Hardware in your building | Stays with you |
If a row above matters to your compliance position, ask us for it in writing before you sign anything. We'll put it in the agreement.
Cloud or on-premises?
The honest answer is that cloud is right for most businesses, and we'll tell you when it isn't.
- Cloud is cheaper, faster, and easier to maintain. It's the right call for most small and mid-sized businesses, and we'll say so.
- On-premises is worth it when the data can't leave. Engineering drawings, regulated records, contractual data-residency terms.
- We use established platforms, not our own. Managed AI workspaces run on third-party infrastructure. We name the vendor before you sign.
- You'll know which is which. Every proposal states where each component runs and who holds the data.
Guardrails
We try to break our own assistants, then show you the results.
Every deployment ships with a written test table: the prompt we attacked it with, and what it did. Including the ones where it refuses to answer.
- Answers only from an approved knowledge file. You sign off on every fact before it goes live.
- Never quotes a firm price or promises an appointment. Ranges only, always labelled as estimates.
- Never gives DIY instructions involving electricity, gas, refrigerant, or climbing.
- Discloses that it's automated in the first message, not in fine print.
- Hands off when it doesn't know. To your phone number or your form — not to a guess.
- Rate limited and length capped. So it can't be used as somebody's free chatbot on your bill.
What you own
- The domain, in your name. Always. We'll manage it; we won't hold it.
- The code. In a repository you control. Plain HTML, no proprietary framework, maintainable by anyone.
- The vendor accounts. Hosting, platforms, everything, billed to you or transferable to you.
- The ability to fire us without losing a thing. That's the test of whether a vendor built it right.
Questions we haven't answered
Ask, and we'll put it in writing.
If your compliance position depends on a specific answer, we'd rather sort it out before a proposal than after a signature.