Question 1

Where does our client data live, and who can see it?

Accepted Answer

By default, every engagement runs inside your tenancy — your cloud account (AWS, Azure, or GCP), your VPC, your CRM, and your carrier connections. We never pool client PII across customers, and access is scoped to a named engineering team under signed BAAs and NDAs. If you require an on-prem or sovereign deployment, that is a first-class option, not a custom upcharge.

Question 2

How do you handle PII, NPI, and HIPAA-class information?

Accepted Answer

We treat NPI, PHI, and HNW client data as restricted by default. Standard controls include field-level encryption at rest, TLS 1.2+ in transit, tokenization of identifiers before they reach any model, role-based access with SSO/MFA, and full audit logging. For health-adjacent workflows (LTC, disability, life underwriting) we operate under HIPAA BAAs and minimum-necessary data principles.

Question 3

Do you train foundation models on our data?

Accepted Answer

No. Your data is never used to train shared or third-party foundation models. When we fine-tune, we fine-tune private models inside your environment on your data, for your use only. When we use hosted LLMs, we use providers and endpoints that contractually disable training on inputs, and we route through a gateway that enforces this.

Question 4

How is a model 'custom-fit' to our practice?

Accepted Answer

We start from your book, your products, and your voice — not a generic vertical template. That means ingesting your CRM (Redtail, Wealthbox, Salesforce FSC), AMS, illustration tools, carrier feeds, and historical correspondence; encoding your suitability rubric and house view; and tuning prompts, retrieval, and fine-tuned models against your own evaluation set. Every system ships with a reviewer-in-the-loop and a measurable accuracy bar agreed up front.

Question 5

How do you address FINRA, SEC, NAIC, and state insurance compliance?

Accepted Answer

Compliance is engineered in, not bolted on. We support FINRA 17a-4 / SEC 17a-4 recordkeeping, NAIC Model #275 best-interest documentation, state suitability requirements, and books-and-records retention with WORM-compliant storage. Every AI-assisted output is logged with prompt, response, model version, and reviewer action so your compliance team can reconstruct any interaction.

Question 6

What about SOC 2, ISO 27001, and vendor due diligence?

Accepted Answer

We deliver inside SOC 2 Type II and ISO 27001 aligned environments, and we routinely complete enterprise vendor security questionnaires (SIG, CAIQ, custom brokerage DDQs). We can provide architecture diagrams, data-flow maps, pen-test summaries, and sub-processor lists as part of onboarding.

Question 7

How do you prevent hallucinations on advice-adjacent outputs?

Accepted Answer

We do not let raw LLM output reach a client. Advice-adjacent workflows use retrieval-grounded responses tied to your approved knowledge base, citation requirements, deterministic guardrails on numerical and regulatory claims, suitability checks, and a human reviewer step before anything is sent. We track factuality and refusal rates as first-class production metrics.

Question 8

Who owns the IP — the models, prompts, and code?

Accepted Answer

You do. Custom models, fine-tunes, prompts, datasets, and source code produced under your SOW are your property, delivered with full documentation. We retain no residual rights to your data or domain-specific artifacts.

A full-stack AI engineering practice.

A full-stack AI engineering practice.

Custom ML Models

Neural Networks

Predictive Analytics

Secure AI Systems

Real-Time Processing

Data Engineering