Raw data never reaches the system that does the reasoning.
Eight controls, each one checkable.
The limits are stated too. A token pass that misses an identifier lets it through. Canaries catch systematic leaks and can miss a one off. Providers process tokenised text under their own terms. The contract comes first: data handling, deletion, and your written approval of the model terms.
A locked vault
Your logs land in an encrypted store outside the operator's own memory, under your contract, with a deletion date that is kept and logged.
Tokens at the door
Names, people, systems, hosts, identifiers and amounts become stable tokens before anything else touches the data. The mapping never leaves the vault.
Code first
The timeline and the action record are rebuilt by deterministic code. A model is consulted only on bounded, tokenised excerpts where judgment is needed, and every such call is marked in the pack.
The reasoning system never opens the vault
Code enforces this; it is not a promise.
Model terms you approve in writing
Commercial terms with no training on inputs; models outside the provider's extended-retention list; zero-retention workspaces where available. Which models and which terms, stated before the engagement.
Your names are never spoken, sent or remembered
They go on a never share list for the engagement and stay out of summaries, messages and the operator's own memory.
A ledger of what left
Every call carrying your data is logged: the tokenised text sent, the endpoint, the terms, the time. Delivered to you with the pack.
Canaries before every engagement
A fake dataset seeded with unique strings runs through the whole pipeline before your data does. One canary found anywhere fails the gate.