Secure AI, data privacy, and PII redaction FAQs.

No — our own systems and staff don't see any of it, identifying details or otherwise. The relay that forwards your message runs inside a hardware-isolated environment (a confidential-computing enclave) specifically so our ordinary infrastructure and engineers can't read into it. The AI provider is a separate case: Claude or GPT still processes the substance of your question — the actual topic, the reasoning — because neither provider offers confidential inference publicly yet. What they never see is the identifying details: names, SSNs, emails, and similar identifiers, stripped out on your device before anything is sent. If you ask about "PERSON_1-C24's case," the AI sees that sentence — it doesn't see who PERSON_1-C24 actually is, and we don't see any of it at all.

Yes. PrivacyAI maintains your account identity for billing, agreements, and support, but keeps that information separate from message content. Requests reach the AI provider through PrivacyAI — not through your firm's individual AI account — and direct identifiers relating to your firm, clients, patients, or filers are removed before transmission. The AI provider does not receive those identities from us.

Not exactly, and two different techniques are actually doing two different jobs here. Tokenization replaces a sensitive value with an unrelated placeholder (like PERSON_1-C24) before it's ever sent — the real name never leaves your device in any form, encrypted or otherwise. Separately, our own relay runs inside a confidential-computing enclave — hardware-isolated processing, not encryption in the traditional sense — so even our staff can't read the message passing through it. Neither is "encryption" in the classic sense of scrambling data with a reversible key; both work by making sure the wrong party never has readable access in the first place, through different mechanisms.

No. Your device sends the redacted message to our backend, which authenticates to the AI provider under our own business account and forwards it. This is what lets the AI provider see only our account — never your individual identity or IP address.

The relay runs inside a hardware-isolated environment (a confidential-computing enclave) specifically so ordinary staff and infrastructure can't read message content passing through it. This protects against our own systems — it doesn't extend to the AI provider's servers, which still process the tokenized text to generate your answer.

Your device swaps the tokens back to the real values using a map that only ever exists locally. That map is never sent to us or to the AI provider.

It reduces one specific failure mode: after the AI responds, we compare its answer against what you actually sent and flag any name, citation, date, or figure it introduced that wasn't in your original message — so nothing invented slips into your draft unnoticed. It's not a legal-research or citation-verification tool like Harvey or Lexis+ AI, and it won't catch a bad citation you typed in yourself — it only catches what the model added on its own.

For healthcare customers, a Business Associate Agreement is signed before PrivacyAI is used with protected health information. The BAA does not transfer your organization's compliance responsibilities to us; it defines our own obligations and safeguards. PrivacyAI helps your organization use AI responsibly and document the controls supporting its compliance obligations.

Not in the absolute sense. PrivacyAI knows which organization and users belong to an account, while the AI provider receives requests through PrivacyAI without those customer identifiers. We retain the account and usage metadata needed to operate the service, but we do not keep logs of message content or the local map connecting redaction tokens to real identities.

If legally compelled, we could identify the customer account that used PrivacyAI, but we generally could not produce content we never retained. The AI provider may retain the redacted request according to its own API terms and retention settings, but that request is designed not to contain the direct identities removed by PrivacyAI.

Depends what you mean by "my data," since most of what you'd expect to delete was never collected in the first place. What's real and deletable: your account and identity records (billing, KYC — required for the accountability agreement), usage/billing metadata (timestamps, volume, held for abuse detection), and, if you opt into cross-device conversation sync, the encrypted history blob itself — we can't read it (zero-knowledge, only your device holds the key), but the stored blob is real and we can delete it on request. What's not part of this because it was never held: raw identifying content. Redaction happens on your device and discards the real values immediately — there's no pile of your clients' names sitting somewhere waiting to be purged.

AWS Nitro Enclaves — a hardware-isolated compute environment built into supported Amazon EC2 instances. AWS has independently affirmed there is no mechanism for its own operators to access what runs inside the Nitro System, and it's backed by AWS's published Service Terms, not just our own claim. Worth being upfront about the tradeoff: naming a specific vendor here means part of our reliability and security posture is tied to AWS's own — the same way it would be for any company built on major cloud infrastructure. If that ever changes, we'll disclose it.

No — those handle visit transcription and note generation. This covers everything else you already do in ChatGPT or Claude: case summaries, patient education material, prior-auth letters, research. Different job, same underlying need to keep identifying details out of it.

Structured data — emails, phone numbers, SSNs, card numbers — is caught reliably. Names and addresses in messy, real-world text are best-effort, not guaranteed 100% of the time. We're upfront about this rather than promising perfection.