Security
Your data stays private, with controls your company can inspect, document, and govern.
For entrepreneurs, founders, and executives. NVIDIA and Apple hardware hosted in the United States. Your private AI runs for your company alone in a US data center. You reach it over a secured connection. Nothing reaches a public AI provider.
Installed in your building. Isolated from the public internet except for controlled updates. Core local inference keeps working if the internet drops.
The data boundary
Your private AI runs for your company alone. Nothing your team types, uploads, or asks reaches a public AI provider.
Inside your environment
Prompts and customer content are not sent to public AI model APIs for inference. Your deployment plan documents the exact data flows, update channels, logging, backups, and support access that apply to your company.
A governed path
Public model APIs are not part of the inference path, and your firm’s content is not used to train a shared model.
Data lifecycle
The deployment record turns the architecture into a reviewable data-flow map. Your company approves the configuration that applies to its environment.
Inputs and outputs
The record identifies approved prompts, documents, retrieved materials, generated drafts, and the systems that can receive reviewed output.
Knowledge and configuration
Approved templates, policies, indexes, model files, and system configuration are inventoried so ownership and access are clear.
Logs and retention
Query, access, administrative, and support records use the retention settings agreed for the deployment rather than an unstated default.
Updates and providers
Update channels and any approved identity, monitoring, backup, or support providers are recorded with their purpose and data path.
Support access
The support process identifies who can request access, who approves it, how it is authenticated and logged, and when it is removed.
Offboarding
The signed scope assigns access removal, configuration export or deletion, record retention, and hardware-return responsibilities.
Actual settings and approved providers are documented for each deployment. Public website language does not override that record or your signed agreement.
Controls
The control set is designed around the way companies manage sensitive information.
Encryption
Full-disk encryption protects stored information. TLS protects supported connections between approved users and the system.
Access
Access is mapped to approved user groups so leadership, managers, and staff can be given the permissions their work requires.
Evidence
Query and administrative activity is logged according to the retention settings agreed for your deployment.
Boundaries
Network access is limited to the paths the deployment needs, including controlled channels for approved updates.
Support
Remote support is enabled only under the access process agreed with your company. Support activity is attributable and logged.
Review
Outputs are drafts. Your professionals review the work and remain responsible for tax positions, advice, and client communications.
The question behind every AI question is whether you would be responsible for something you did not control. Here is how the system is built so that you stay in control.
Every answer drawn from your documents shows the passage it came from. Your retrieval system pulls that passage from the actual file; your model does not write it. When your documents do not contain the answer, your AI says so instead of guessing. Only approved workflows run, so requests for tax positions, legal advice, or numbers you did not provide are outside its scope. Nothing reaches a client without approval from a named person. For the first ninety days, your dashboard records how often drafts were accepted without correction, per workflow. Your firm decides where to relax review and where never to. Nobody is asking you to trust the AI. You are trusting a process that lets you decide how much to trust it.
Your model keeps no memory from one conversation to the next. Instructions a user types end when that conversation ends. Behavior changes happen only through your administrator change process, versioned and logged. Retrieved documents are material to summarize or cite, never instructions. The fixed order of authority is system, administrator, user, documents. Every query records who asked, what was retrieved, and what was answered. Your firm sets retention. Attempts to change behavior or reach restricted material are flagged to your administrator, even when they return nothing.
Each indexed document carries its permissions from your systems. On every question, your retrieval layer first filters to documents the person asking may open. Only those passages reach your model. The filter runs before your model, not after. No phrasing can reach a document that was never retrieved. Nothing is indexed until an owner approves the collection and who may see it. This is default deny. Payroll, personnel files, partner compensation, and transaction plans stay out entirely or in restricted collections for named roles. Conversations and uploads stay in that user’s scope. There is no shared memory and no shared cache of answers. Connections to other systems run as the user, with that user’s permissions, never with a master credential.
Your system has two layers. Your model is adapted on material everyone in your firm may see: templates, formats, terminology, and voice. That makes a first draft sound like your firm. Facts, client specifics, numbers, and prior work are never memorized. They are retrieved at the moment of your question from documents you may open and shown with their source. Facts live in your index, not your model. Updating or removing a document changes the next answer without retraining. A client’s data leaves when their documents do. Once information is trained into a model, there is no permission on it and no way to delete it without retraining. Nothing client-specific or restricted is ever trained into your model.
Before launch, role-based test accounts attempt to retrieve restricted compensation, personnel files, and transaction plans. The correct result is nothing. Tests and results are recorded in your deployment record. Model updates follow a controlled process your firm is told about. They are never pushed silently. Your deployment record assigns responsibility in three parts: your people for what they send, your firm for the configuration it approves, and PrivateStride for your system behaving as that record says.
Your people can talk to it. Only administrators can change it. Every question, answer, and change is logged.
Your AI can only see what you can already open. Permissions come from your systems, not from the AI.
It learns how your firm writes. It looks up what your firm knows, one question at a time, only from documents the person asking is allowed to open.
Read the full guide: How private AI handles wrong answers, sabotage, and who sees what
Regulatory support
Private infrastructure can reduce unnecessary external data flows. It does not replace your company’s legal, professional, or security responsibilities.
FTC Safeguards Rule
The Safeguards Rule requires covered financial institutions, including many tax preparation firms, to maintain an information security program with administrative, technical, and physical safeguards. PrivateStride provides documentation about your AI system and its controls, then works with your designated security lead so your company can decide how to incorporate the deployment into its written information security plan.
Read the Safeguards Rule and AI guideIRC Section 7216
Section 7216 and its regulations govern certain uses and disclosures of tax return information by tax return preparers. An on-premises architecture can reduce external data flows, but location alone does not determine compliance. Your company remains responsible for evaluating intended uses, disclosures, consents, and contractual arrangements with its advisers.
Read the Section 7216 and AI guideFor CPA firms, see private AI for CPA firms.
For law firms, see private AI for law firms.
For wealth management firms, see private AI for wealth management firms.
For insurance firms, see private AI for insurance firms.
Sources: the FTC’s official Safeguards Rule guidance and the IRS Section 7216 Information Center. PrivateStride provides technical and implementation support, not legal advice or a certification of compliance.
A usable policy
When approved tools do not fit the work, people may turn to unapproved services. PrivateStride gives your team a governed path for AI-assisted work inside your environment, with access controls and activity records your company can manage.
The goal is simple: make the approved way useful enough that your people do not need a workaround.
Use the managing partner’s shadow AI guideThe Private AI Assessment
Choose cloud-hosted or in-building, or let the fit call recommend which fits. Two weeks, done remotely, with a written report and a fixed quote. Cloud-hosted is credited in full toward implementation within 90 days; in-building is credited in full toward installation within 90 days.
Both assessments are done remotely, by video and phone. Nobody travels.
