Data that legallycannot leave
When residency is not a preference but a requirement.
The clean answer
The cleanest possible answer to a data-residency question is that inference happens on premises, on owned hardware, with no third-party processor in the chain at all. What that means differs by regulator:
- Legal: privilege and work product never touch a third party — the “reasonable efforts” Model Rule 1.6(c) asks for becomes a property of the architecture, and the disclosure questions ABA Formal Opinion 512 raises about generative-AI providers mostly dissolve when there is no provider
- Health: patient records are processed in the room they already live in — no BAA chain, no cloud transcription of consultations
- Finance: client data and positions never transit a third-party API — the vendor-risk questionnaire collapses to one machine you can point at
Auditable by inspection
No DPA negotiation, no sub-processor list, no cross-border transfer analysis. The audit is: here is the machine, here is the network, nothing leaves.
The stack we set up for this
Configured for data that cannot leave:
- Document pipelines — OCR, extraction, filing — fully on premises
- Dictation and drafting over privileged or patient records, offline
- Per-matter workspaces in the chat app — access separated the way your conflicts wall is
- Air-gap-capable: the stack runs with the network cable unplugged
The remote-access question, answered in writing
Support access is customer-initiated through a private tunnel — off by default, never an open port, and refusing it does not cost you support. Diagnostics are triggered by you and redact prompts and documents before anything is shared. Put this paragraph in front of your malpractice carrier; it was written for them.
Start smaller than the demo
You do not have to start at the top of the line. The pilot we recommend to firms: one desk box at €6,450 / $6,699 all-in, loaded with closed-matter files, ninety days. If it does not earn its keep, you have spent less than one associate-month finding out.
What a subpoena finds
When chat-scanning rules order providers to hand over conversations, there is no provider in this chain to order. Every other vendor sends you a DPA to negotiate; this machine sends nothing anywhere, and that is the entire compliance story.