Everything runs in infrastructure you own. That is the security model.

Everything runs in your own tenancy — your cloud account, your automation instance, your vector database, your model API keys. That is deliberate on three grounds: you never lose access to your own operations if we stop working together, you see the real running cost directly rather than through my markup, and it keeps the arrangement clean under the licences of the tools involved.

Only what the workflow you approve has to send, to the model providers you have chosen, from infrastructure you control. I will give you a written one-page summary before any build starts covering which sub-processors are involved, what is sent to each, where it is stored, how long it is retained, and how it is deleted. Where a provider offers a no-training-on-your-data setting, that is the configuration used by default.

No single one, on purpose. Everything is built on the model providers and platforms you choose, running on your own API keys in your own accounts, so the recommendation can be honest: it comes out of the diagnostic, against your actual workload, rather than out of a reseller agreement — nothing is resold and no commission is involved. Where a provider offers a no-training-on-your-data configuration, that is the default. And because every build ships with an evaluation suite, changing model later is a measured regression run rather than a leap of faith — Care retainers carry model migration for exactly that reason.

You do, on full payment. The workflows, the prompts, the evaluation suite, the runbook and the source all live in your repositories and your infrastructure from day one. I hold delegated admin access during the engagement, which you can revoke at any time. There is no vendor lock-in to unwind, because there is no vendor tenancy to be locked into.

Every deliverable that touches a language model ships with an evaluation suite: at minimum forty golden question-and-answer pairs, a documented pass threshold, and a regression run before handover and before any subsequent change. It means "the assistant got worse" becomes a number you can check rather than an argument. Very little at this price point ships with one, and it is the main reason to choose this over a cheaper prototype.

Every build ships with retries, timeouts, dead-letter handling and failure alerting into a channel your team already reads, plus a written runbook. There is a 14-day bug window after handover at no cost. Beyond that, a Care retainer covers monitoring and fixes with a response SLA of two business days, one business day, or four business hours depending on tier. Without a retainer you can still call me — it is quoted as ad-hoc engineering.