Frequently asked questions

We implement enterprise AI systems. Architecture, infrastructure, integration, security, and operations — from assessment through production and ongoing operation. We are an engineering firm, not a strategy consultancy or an agency.

No. We do not produce AI-generated content, images, or marketing material. We build production software systems.

A conversational interface is occasionally the right front end for a system we build. It is never the project. Most of our work is retrieval systems, agents, and AI integrated into existing enterprise workflows — much of it with no chat interface at all.

No. We hold no reseller agreements and take no vendor commissions. It is the only way our architecture recommendations are worth anything.

Scale and incentive. We staff small senior teams — the architects who design the system build it. And because we have no platform to sell, we can recommend against a technology without it costing us anything.

AI systems where inference runs on infrastructure you control and your data never reaches a third-party processor. Four boundaries have to hold: network, storage, identity, and telemetry. A deployment that satisfies three of four is not private.

Yes. Air-gapped deployment changes model update logistics, monitoring, and dependency management significantly — those are engineering problems with known solutions, and they need to be designed for from the start rather than retrofitted.

For retrieval, extraction, classification, summarization, and most agentic workflows, yes. For the hardest reasoning tasks, frontier models still lead. We evaluate against your actual workload rather than against benchmarks, because benchmark rank rarely predicts performance on a specific enterprise task.

Not necessarily. Options include reserved cloud GPU capacity in your tenant, colocated hardware, or existing on-premise capacity. We model the options — purchase is one outcome, not the assumption.

Yes, regularly — Azure OpenAI, Bedrock, Vertex, and hyperscaler infrastructure. Private deployment is our specialty because it is where clients are most stuck, not because it is always the answer.

On a private deployment, architecturally: there is no external processor in the data path. We document the controls enforcing each boundary and produce the evidence your security team and auditors require.

No. On a private deployment there is no third party with access to train on. Where a managed API is used, we configure and verify no-retention and no-training terms and document them.

Architecturally, not by prompt engineering. Treat retrieved content as untrusted input, constrain tool access with least privilege, gate consequential actions, enforce entitlements at the retrieval layer, and test adversarially before release. Defenses that live entirely in the system prompt are not defenses.

We align AI governance to NIST AI RMF and ISO/IEC 42001, and design to the sector frameworks our clients operate under — HIPAA, HITRUST, GLBA, SR 11-7, CMMC 2.0, NIST SP 800-171, ITAR, FedRAMP, and CJIS among them.

Yes to an NDA, before any detailed technical discussion. We will also sign a BAA where PHI is in scope.

Almost always with an AI Readiness Assessment. It is fixed-fee, time-boxed, and produces a roadmap you own — executable by us, by another firm, or by your own team.

It depends on deployment model, integration surface, and security requirements. We provide a fixed-fee assessment first precisely so the implementation estimate is grounded in your actual environment rather than in assumptions.

For a scoped first use case, it depends on data readiness, integration complexity, and your security review timelines. Security review is the most frequently underestimated component, and we plan around it rather than discovering it.

Yes. Ongoing LLMOps and operations, or a structured handover to your team with runbooks and training. Both are legitimate outcomes; we will recommend which fits your staffing.

No. We scope engagements to outcomes with defined artifacts and acceptance criteria.