How it runs

The work runs inside your environment. We deploy a harness into your infrastructure (your CI, your cloud account, or an ephemeral VM we destroy afterwards) and it never leaves. We retain the receipt, not the material.

This is the market standard for enterprise AI evaluation. It also changes what your security team has to assess. You are not auditing a processor that holds your records; you are assessing software you are about to run inside your own systems. That is a smaller question than a processor audit. It is not an absent one.

The five steps

1. Capture (your environment). Extract the claims the system makes about its own effect, from its logs, its reports and its self-declarations.
2. Re-execute (your environment). Independently re-run the effect and read the result: the reconciliation math, the code, the data transform.
3. Falsify (your environment). Adversarially probe for the claim-vs-effect gap.
4. Adjudicate. For claims with no answer key, signed expert judgment.
5. Sign and deliver. Ed25519-sign each verdict, content-address it, and hand you the receipts. We publish nothing of yours.

The one honest exception

Some claims have no answer key and need a human expert to read material. If that expert is ours, content moves, and calling it anything else would be a lie. The three options are:

• scope the engagement to deterministic claims only,
• have the expert work inside your environment as well, or
• disclose the transfer explicitly in the data-processing agreement.

We tell you which one applies to your engagement before you sign, not after. We will not describe a judgment engagement as “your data never leaves” when it does.

What we never hold

Your data, your model, your prompts, your outputs and your customer records. What we keep is the receipt: a signed record of what was checked, what the effect was, and when. The receipt contains no customer material.

Why this shape

Running inside your environment shrinks the data question. It does not remove the software question.

Because we never take custody of your records, we are not a processor of them. No retention clock runs against your data, and no copy of it sits in our account.

We are still software you are about to run inside your own systems. So you are entitled to ask what the harness can read, what it can reach on the network, whether it can see your secrets, and what it leaves behind when it stops. We answer those in writing for the specific engagement, before you deploy.

We do not hold a SOC 2 Type II report. Running locally does not make one unnecessary, and we will not claim that it does. If your security team needs a control we have not documented, we would rather hear it on the first call than during procurement.

Getting a harness into your environment

The real gate on a first engagement is deployment access, and it will be the slowest part. We start with the deterministic, low-sensitivity workflows (reconciliation math, not live trading) so that the first deployment into your CI or cloud account is a small one.