Your data doesn't leave. Here is how that actually works
The first question on every call with a head of IT. A one-page answer, without big words.
"Does our data leave?" It is the first question, and rightly so. Here is the answer we give, layer by layer.
The model
When your employee writes to Claude or ChatGPT through an enterprise subscription, the request goes to the vendor's cloud. On enterprise channels and APIs, vendors commit contractually that the data is not used for training and is not kept beyond processing time. That policy is called Zero Data Training, and it lives in the commercial terms, not on a marketing page.
If even that is too much, there are open models that run inside your network. Less capable, zero egress.
The connectors
Every connection to a core system, ERP or CRM, runs under a separate service account with least privilege. The agent that reads invoices cannot reach payroll. The agent that prepares quotes cannot delete a customer.
The writes
Iron rule: every write to a core system passes a human. The agent prepares, flags, and waits. It slows things a little. It is also what lets you sleep at night.
The log
Every action, every decision, every tool call is recorded. The log is yours, and it can be wired into your existing monitoring.
At the end
When the engagement ends, the code and data transfer to you. The subscriptions were in your name all along. We hold nothing of yours, at any stage.
None of this is complicated. It requires deciding upfront, and writing it into a one-page policy. Do you have a written AI policy today?