Staff can get answers from company data without that data leaving, if the model, the index and the permissions all sit on hardware the organisation owns. Retrieval happens locally, answers cite approved sources, entitlements are applied before ranking, and every consequential action is sealed in a record an auditor can verify offline.
What actually leaves the building when someone asks an AI assistant a question?
More than the question. A hosted assistant grounded in your own documents sends three things out: the prompt, the passages it retrieved from your material to ground the answer, and usually the preceding turns of the conversation. The retrieved passages are the sensitive part. A colleague typing "what did we agree on termination with this counterparty" is not sending a question offsite. They are sending the clause.
Copies then accumulate in places nobody on the deal team ever sees: the embedding index, request logs, caches, retry queues, and sometimes evaluation sets. Under the Data Protection Act 2018 and UK GDPR you remain the controller for all of it, and the ICO's security guidance expects you to know where personal data sits and who can reach it. A contractual promise that a vendor will not train on your data is a promise about training. It is not a statement about where the bytes went.
Why is the data boundary an architectural line rather than a policy?
Because a policy describes intent and an architecture describes what is possible. If a system can send your documents to a third party, then everything that stops it is a promise: a configuration flag, a contract clause, an access review, a person remembering. Promises degrade quietly and they degrade under deadline pressure.
Put the model, the index, the retrieval layer and the audit record on hardware the organisation owns, with no route to a third-party endpoint, and the property stops depending on behaviour. The NCSC's cyber security design principles make the same argument in a different register: make compromise structurally difficult, rather than instructing people to avoid it. I would rather defend a boundary a network diagram can show than a boundary a policy document asserts.
That is the line the Mickai Sovereign Intelligence Operating System is built around. It runs on the customer's own hardware, it is offline capable, and there is no data egress.
What is a company brain, and how is it different from a chatbot over a search box?
A company brain is four things held together: a model that reads, an index of your own material, the permission model of the systems that material came from, and a record of what was done with it. Remove any one of the four and you have something else, usually something that will embarrass you in an audit.
We build with 50 specialised models rather than one general one, because the material a firm actually argues about is domain-shaped. Contract language, engineering change notes, incident reports and board minutes each have their own conventions, and a model shaped for one reads the others badly.
The real difference from a search box is accountability for an answer. Search returns documents and leaves judgement with the reader. An assistant produces a claim. So the claim has to carry its sources, the version of each source, the date, and the identity of the person who asked. Without that, you have introduced an unattributable statement into a regulated process, and you have no way to reconstruct why a decision was made.
How do you stop it answering from documents the person is not allowed to read?
You apply entitlements before retrieval, not after it. The common failure is to index everything into one flat store, retrieve the best passages for the question, then filter at display time. By then the leak has already happened: the model has read material the person cannot see, and the answer it writes is shaped by it even when no sentence is quoted directly.
The correct order is to identify the person, resolve their entitlements from the source systems, restrict the candidate set to what they may lawfully read, and only then rank and answer. Entitlements are re-checked at answer time, because a person's access changes and a cached index does not notice. If someone may not open a file, they may not receive a paraphrase of it, a figure derived from it, or a hint that it exists.
This also disciplines the corpus, which is the unglamorous benefit. Material with no owner and no access model is material nobody should be answering from, and the exercise of connecting a company brain tends to find quite a lot of it.
What counts as approved knowledge, and who decides?
Approved knowledge is the subset of your material that a named person has signed off as current and answerable, with a review date attached. Everything else stays searchable by whoever owns it, but it does not get to speak for the organisation.
In practice that is three states. Draft: visible to its author and immediate team, never used to answer across the firm. Approved: carries an owner, a version and a review date, and can ground an answer. Superseded: excluded from retrieval, retained in full, still reachable when somebody needs to reconstruct what the policy was in March.
This is the dull part and it decides whether the system is trusted in month six. The failure mode of an internal assistant is rarely a dramatic invention. It is quietly answering from a procedure that was replaced two years ago, fluently, with nothing on the face of the answer to tell the reader that the grounding is stale.
How do you prove to an auditor that the data never left?
You give them something they can check without trusting you. Every consequential action is sealed in the Open Audit Record under ML-DSA-65, the post-quantum signature scheme NIST published as FIPS 204 in 2024. An auditor exports a record and verifies the signatures offline, with a public key, using tools that are not ours.
Be precise about what that buys, because the category is routinely oversold. The record is tamper-evident. Nothing physically prevents somebody altering an exported file. What the signature does is make the alteration fail verification, so "this is what happened" stops resting on our word or on our logs.
Alongside it, consequential actions wait for a named person to approve them before they run, and the approval is part of the record: who, when, and on what evidence. For firms inside the FCA's operational resilience expectations, that is the difference between describing a control and demonstrating one. The approach sits behind 104 filed UK patent applications carrying 2,340 claims, filed and not granted, owned by Mickai LTD.
Where does the cloud still earn its place?
Most places. I am not arguing against the companies that build the compute and cloud layer, and a regulated organisation that hauls everything back on-premises because of one class of data has overcorrected at real cost. Public-facing content, bulk non-regulated workloads, elastic capacity for work that is not sensitive: the economics there are good and the risk is manageable. The NCSC's cloud security guidance is a sensible way to make that call deliberately rather than by default.
The argument is narrower than the usual framing. It is with the assumption that a regulated organisation has no option but to rent its intelligence, ship its most sensitive material offsite, and accept a supplier's account of what happened to it afterwards. Draw the line by data class. Some work belongs inside the building, and for that work the boundary should be structural rather than contractual.
What does a first deployment actually look like?
Smaller than people expect. One department, one narrow corpus with a real owner, hardware sized for that workload, and a fortnight of asking the system questions the team already knows the answers to, because that is how trust gets earned and how the gaps in your own document estate surface.
The platform ships 14 production-ready studios at launch, with 49 more in development towards 63 in total. The closed beta is open and one regulated company is onboarding as a design partner. My advice is to start where the data boundary is already costing you something: the workflow where a useful tool is banned, or allowed only with a redaction step that somebody does by hand. Get that one working properly, and the second department will ask to be next.
Frequently asked questions
Does keeping data inside mean staff lose access to public information?
No. The boundary applies to your own material, not to the wider world. Public research, published guidance and open datasets can be brought inside deliberately, reviewed and added to approved knowledge. What changes is the direction of travel: information comes in under review, rather than your documents going out under a contract you cannot inspect.
How is this different from a private cloud tenancy or a dedicated instance?
A dedicated tenancy narrows who else sits on the hardware. It does not change who operates it, where the logs land, or whose account you rely on for what happened. Running on hardware you own changes the trust model itself: the operator is you, the record is yours, and an auditor can verify it without asking a supplier for permission.
What stops the assistant answering from a policy that has been replaced?
Version state. Approved knowledge carries an owner, a version and a review date, and superseded material is excluded from retrieval while being retained for audit. Answers cite the source and version used, so a reader can see at a glance whether the grounding is current rather than trusting the fluency of the reply.
Is the Open Audit Record tamper-proof or tamper-evident?
No, and we do not claim it is. It is tamper-evident. Each consequential action is sealed with ML-DSA-65, the post-quantum signature scheme published by NIST as FIPS 204 in 2024. Anyone can alter an exported record, but the alteration makes verification fail, which is the property an auditor actually needs in practice.
Which organisations is this built for?
Regulated ones: finance, law, defence, public sector, manufacturing, energy and professional services. The common factor is obligation rather than size. If you have to evidence where data went, who approved an action and what that action was based on, the boundary has to be architectural rather than contractual. The closed beta is open now.
Written by Micky Irons, founder and chief executive of Mickai LTD, which builds a sovereign AI operating system for regulated organisations. More at mickai.co.uk.
Top comments (0)