Built to hold
one firm's boundary.
Firm isolation, US residency and the rules the model works inside are enforced in code. The gate runs before anything ships.
Security lives in the architecture of the system itself.
Hard tenant isolation
- Row level security forced on every tenant table
- A least privileged app role that cannot bypass it
- Per transaction scoping that fails closed when absent
- Continuous adversarial isolation tests in CI
US data boundary
- Primary region US East, encrypted automated backups, in the US
- Infrastructure defined as code and pinned to US regions
- Models and providers pass a geography gate before admission
- Objects encrypted at rest. Public access fully blocked.
The model
- Retrieval is authorization first. Nothing unauthorized reaches a model.
- Deterministic rules compute the final figures, and the model cannot alter them.
- A trace records the call ID and what it cost. It never records content.
- Prompt injection is treated as a first class threat, with layered defenses between your sources and the model.
- Your documents are never used to train a model, ours or a provider's.
Compliance and lifecycle
- Data subject requests (DSR) and secure deletion with a hash addressed certificate ledger.
- New York, California, and Illinois breach clocks driven by a durable response workflow.
- Support access is just in time, bound to a ticket, and never includes content.
- When a firm leaves, its workspace is deleted and the deletion is certified in the ledger.
What is not finished.
TenantRepAI runs in private preview. Before the first client document enters the system:
- counsel's retention and prohibited data policies are finalized
- zero data retention is configured with the model provider
- an external penetration test runs
- a disaster recovery restore is exercised
- the data processing agreements with the model and cloud providers are executed
SOC 2 Type 1 follows, then Type 2.
Each item moves up into the controls above with a date when it closes.
Want the architecture detail?
We share the security architecture and data handling posture with founding firms under NDA.
Bring a deal