Who we sell to now
Selling now: Accountancy practices · Estate agencies · Bookkeeping desks · Property management · Recruitment ops · Professional service offices. Same paste-into-ChatGPT leak fear across the list — not “all SMEs,” not legal AI.
Industry landing pages later (packs already in code): Logistics desks · Commercial interiors & trades · Retail & dealerships. Channel next: accountant networks / MSPs with a referral fee — see Partners.
100% data sovereignty & GDPR posture
Isolated multi-tenant node architecture. By default, client matter text is processed inside an isolated private data container on United Kingdom hardware in Staffordshire and does not train public models. Public-cloud inference overflow stays off unless you explicitly enable a named overflow path. Tenant borders are enforced in code. Edge login and card payments use named processors (Cloudflare Access; Stripe) — they are not the inference model.
Automatic De-ID before the model
Where De-ID is enabled for your organisation, UK-focused pattern scrubbing runs before the model (emails, phones, NI numbers, postcodes, money, titled/labelled names, common org suffixes, street lines) with a session-only reverse map for admins — not full NER. Residual identifiers can remain; treat output as still confidential.
Stay-on-Page — Documents vs chat
Documents Stay-on-Page is extractive: fill from the uploaded source only (no free-form invention of parties or figures). Chat Stay-on-Page is generative but buffered — invented assertions are stripped or refused; it is not the same as Documents extractive mode.
Ephemeral matters by default
In-progress drafts default to session/RAM and are not kept on host disk across reboot. Durable on-disk retention is optional and only when enabled for that engagement. Account, billing, and organisation records are retained to run the Service.
Cryptographic operator audit
De-ID events, AI drafts, completed amber checks, sole-approver acknowledgements, and admin unlocks are hash-chained and exportable as an operator audit pack PDF — an operational trail for Practice Managers, not a training certificate.
Organisation templates, not a private fine-tune
Upload internal templates; the node builds a structure/style brief (headings, openings, placeholders) for drafting prompts. That is not per-organisation model fine-tuning and is never used to train public models.
Human unlock before client issue
Where Admin Review is enabled for a workspace, drafts stay locked until a named human checks amber flags and unlocks issue. Cool-down applies before unlock. Autonomy handles the work; humans remain responsible for regulated or client-facing send. Bookkeeping / general admin desks may use named self-unlock where configured.
Book a 45-min secure desk demo on your own files. Compare speed and privacy against public ChatGPT before you change anything — after the isolation proof if you prefer not to sit a live call first.