Security
Your data goes only where you allow it.
Every agent we build runs in one of three ways. Here is exactly how each one works, what it can see and what it keeps, so you can choose with the facts in front of you.
Three ways to run an agent
Each one, from start to finish.
Every agent we build runs in one of three ways, chosen by the security and compliance around the data it will act on. Take them one at a time.
In your provider’s cloud
Your agent sends the work to your AI provider’s business service (for us, Anthropic’s Claude), and the answer comes straight back.
Your firm
Your systemsThe agent
Anthropic · stored in the US
The AI model
Kept 30 days, longer if flagged- How it works
- The agent runs on your team’s computers or in your firm’s own code account. When it needs the AI, it sends the work to your provider’s business service, such as Claude, and the answer comes straight back.
- Where the AI runs
- Stored in the US. It may be processed in the US, Europe, Asia or Australia, unless agreed otherwise with Anthropic.
- Who can see your data
- Your firm and Anthropic. Anthropic’s service runs on Google Cloud, Amazon Web Services and Microsoft Azure, which process it on Anthropic’s behalf. Anthropic may review content its automated safety checks flag, and process data for support or to deal with an incident. Its business terms bar it from training on your data unless someone at your firm sends it feedback or otherwise allows it.
- What is kept, and for how long
- Agent work through Claude Code is kept for up to 30 days. Chats stay in your Claude account until you delete them, or for a retention period your admin sets (Enterprise, at least 30 days), and leave Anthropic’s systems within 30 days of deletion. Content flagged by safety checks can be kept for up to 2 years, and longer where the law requires.
- Which AI it uses
- Claude models, as Anthropic makes them available to your plan.
- What your firm needs
- Business seats with your AI provider, such as Claude Team or Enterprise.
- How it is paid for
- Team: a monthly price for each seat, plus extra usage if you switch it on. Enterprise: a monthly price for each seat, plus usage.
- Best for
- Drafting, research, internal admin, and work without sensitive client data.
- The honest limit
- Your data is stored in the US and handled by Anthropic, which may review anything its safety checks flag.
Inside your own cloud
The agent and the AI model both run inside a cloud account your firm owns, in a data centre you choose.
Your firm
Your systems
Your cloud account · London
The agentThe AI model
Set to keep nothing- How it works
- Both the agent and the AI model run inside a cloud account your firm owns, in a data centre you choose, such as London. The work never goes to the AI company.
- Where the AI runs
- In the data centre you choose, such as London, inside your own account. We only use models that run entirely inside it, so your requests never leave that region.
- Who can see your data
- Your firm, and Amazon, which runs the service. Amazon’s operators cannot see what goes into or comes out of the model. Anthropic has no access to it; Amazon may tell Anthropic how much you use the model, but not what you sent. Amazon’s contract says it will not access or use your data except to provide the service, or to comply with the law or a binding government order.
- What is kept, and for how long
- Nothing from the AI step: retention is set to none, and Amazon refuses any model that would need to keep data. The one exception in Amazon’s terms is narrow: a flagged image may be kept and reviewed to check whether it is illegal abuse material. Your only record is your own log, in your account, encrypted with a key your firm controls, kept for as long as you choose.
- Which AI it uses
- The Claude models that run entirely inside your chosen region. In London that is Opus 5.5 and Sonnet 5. Others, such as Fable 5, would leave it, so we do not use them.
- What your firm needs
- A cloud account in your firm’s name. We set it up with you.
- How it is paid for
- Pay as you use, on your firm’s own AWS bill.
- Best for
- Client financial records, documents, and anything personal.
- The honest limit
- Amazon is a US company, so US authorities can, with a valid legal order, require it to hand over data, even data held in London. Amazon says it would first try to redirect them to you, tell you if allowed, and challenge overbroad requests. As of June 2025, it reports no such handover of business data held outside the US since it began reporting the figure.
In your own building
A private AI model runs on a computer in your office, with the agent beside it.
Your building
Your systemsThe agentThe AI model
Nothing sent to an AI company- How it works
- A dedicated computer in your office runs a private AI model, and the agent runs beside it. Your files are read and written on your own network.
- Where the AI runs
- In your office.
- Who can see your data
- Only your firm, and us while you leave our remote access switched on. You can switch it off at any time.
- What is kept, and for how long
- Everything stays on the computer in your office for as long as you choose.
- Which AI it uses
- A private open model: strong at clear, defined jobs, less able on long, complex ones.
- What your firm needs
- The computer, which we specify and set up, kept on and backed up.
- How it is paid for
- Hardware your firm owns. No bill for each use.
- Best for
- Work your contracts say must never leave the building.
- The honest limit
- Narrower jobs and more human checking. Your data is only as safe as that computer and whoever can reach it, including us while remote access is on.
Sources, checked 13 October 2026
No third party’s terms apply: we set this up and run it with you, on hardware your firm owns.
Side by side
Where they differ most.
| 01In your provider’s cloud | 02Inside your own cloud | 03In your own building | |
|---|---|---|---|
| Who can see your data | Your firm and Anthropic. Anthropic’s service runs on Google Cloud, Amazon Web Services and Microsoft Azure, which process it on Anthropic’s behalf. Anthropic may review content its automated safety checks flag, and process data for support or to deal with an incident. Its business terms bar it from training on your data unless someone at your firm sends it feedback or otherwise allows it. | Your firm, and Amazon, which runs the service. Amazon’s operators cannot see what goes into or comes out of the model. Anthropic has no access to it; Amazon may tell Anthropic how much you use the model, but not what you sent. Amazon’s contract says it will not access or use your data except to provide the service, or to comply with the law or a binding government order. | Only your firm, and us while you leave our remote access switched on. You can switch it off at any time. |
| What is kept, and for how long | Agent work through Claude Code is kept for up to 30 days. Chats stay in your Claude account until you delete them, or for a retention period your admin sets (Enterprise, at least 30 days), and leave Anthropic’s systems within 30 days of deletion. Content flagged by safety checks can be kept for up to 2 years, and longer where the law requires. | Nothing from the AI step: retention is set to none, and Amazon refuses any model that would need to keep data. The one exception in Amazon’s terms is narrow: a flagged image may be kept and reviewed to check whether it is illegal abuse material. Your only record is your own log, in your account, encrypted with a key your firm controls, kept for as long as you choose. | Everything stays on the computer in your office for as long as you choose. |
| Which AI it uses | Claude models, as Anthropic makes them available to your plan. | The Claude models that run entirely inside your chosen region. In London that is Opus 5.5 and Sonnet 5. Others, such as Fable 5, would leave it, so we do not use them. | A private open model: strong at clear, defined jobs, less able on long, complex ones. |
| Best for | Drafting, research, internal admin, and work without sensitive client data. | Client financial records, documents, and anything personal. | Work your contracts say must never leave the building. |
Which one is right for you
Start with your data.
Think of one job you want an agent to do, and find the line that fits it.
The work doesn’t touch client records or personal data.
01 · In your provider’s cloudIt touches client data, and your own cloud account is allowed to hold it.
02 · Inside your own cloudA contract or policy says the data must never leave your building.
03 · In your own building
Not sure? Most firms use more than one. We decide solution by solution, with you, and write the reason down.
Whichever way it runs
Every agent works under your control.
The same safeguards come with every one we build.
And us
What we can see.
Only what you give us access to, through logins your firm can switch off at any time.
Our policy: we never keep copies of your client data on our own systems.
- 01
Its own login
Access to only the tools its job needs, and nothing else.
- 02
A person signs off
Anything that leaves your firm waits for a named person to approve it.
- 03
Every run on the record
A log of everything it did, and a switch to pause it.
- 04
The compliance work done
The data protection assessment, the map of where its data goes, and the wording for your engagement letter.
Choose with the facts. Ask us anything.
Bring the questions your partners will ask. We will answer them on the call.