Once a prompt leaves your building, the vendor's privacy policy is the only control left, and you can't audit a policy. You can audit a design. So before any AI vendor gets near client records, ask to see how the system is built. We published ours, including the parts that aren't built yet. This post walks through it so you know what to look for in anyone's.
Plans come before permits
No city lets a contractor pour a foundation on a promise. The plans go to plan review first, and someone who doesn't work for the contractor checks them before a shovel moves. The order matters: a mistake is cheap to fix on paper and expensive to fix in concrete.
AI adoption in most small practices runs the other way. Staff start using a tool, the data starts moving, and the questions come later, if they come at all. For a medical practice, a law firm or a financial office, later is too late. Whatever went out under the old terms is already out.
Five questions a design should answer
A design worth trusting answers these in writing:
- Where does the model run? On your premises, in the vendor's cloud, or both.
- What can leave, and who decides? Is there a default, and who can change it?
- What is kept, and where? Prompts, answers, logs, and the indexed copies of your documents that retrieval depends on.
- What does it cost, and for how long? Including the minimum term.
- What isn't built yet? Every system has gaps. The question is whether the vendor shows you theirs.
If a vendor can't answer one of these on paper, that is the answer.
Ours, tab by tab
Our private LLM architecture page answers each question on its own tab.
Workflow Diagram answers the first three. The model runs on an appliance at your site. Requests from physicians, attorneys and office staff pass through one gateway. Work stays local by default; an outside model is used only for workloads enabled in advance. Every call is logged on storage you own.
Data Routing Policy puts the second answer in writing. Routing is decided per workload, not per request. Turning on an outside workload takes a change request signed by your designated owner. Regulated data stays local unless five conditions are all met, including a BAA or DPA with the provider and zero data retention confirmed in writing. The full policy is here.
Service Tiers answers the fourth: three seat bands, two ways to finance the hardware, and a 12-month minimum. The performance figures are labeled as targets, because that's what they are until the production build is validated.
R&D Log answers the fifth. Every entry is dated. Some say "Not started."
The other tabs show the reasoning. Value Gap Analysis sets our service against three named products, UpToDate Expert AI, CoCounsel Legal and LexisNexis Protégé, and shows where each stops for a regulated practice. API Landscape covers the outside data sources a deployment can draw on. Research Summary pulls the findings together.
Why we show what isn't finished
A vendor with no visible gaps is a vendor whose gaps you can't see. The log's unfinished entries are the reason to believe the finished ones. If we hid the work in progress, you'd have no grounds to trust what we say about the work that's done.
The log also tells you where things stand. This is a service being built and validated in our lab, not one running at client sites today. Better you learn that from the page than from the contract.
What the design doesn't settle
Running the model on-premises settles where the data goes, which model answers and where the record lives. It doesn't settle who in your office may retrieve which documents, which answers need a qualified reviewer, or who patches the server. Those stay with your practice under any architecture, ours included. The architecture page's Governance tab maps each one, and our AI governance reference covers all six layers, with the corrections a small practice needs.
Use it as a checklist
Hold any AI vendor to the five questions, including us. Ask for the answers in writing, before anything is installed. If you'd like to walk through ours with your IT person or your compliance lead, get in touch.