The questions we get asked on almost every call.

No — our own systems and staff don't see any of it, identifying details or otherwise. The relay that forwards your message runs inside a hardware-isolated environment (a confidential-computing enclave) specifically so our ordinary infrastructure and engineers can't read into it. The AI provider is a separate case: Claude or GPT still processes the substance of your question — the actual topic, the reasoning — because neither provider offers confidential inference publicly yet. What they never see is the identifying details: names, SSNs, emails, and similar identifiers, stripped out on your device before anything is sent. If you ask about "PERSON_1-C24's case," the AI sees that sentence — it doesn't see who PERSON_1-C24 actually is, and we don't see any of it at all.

Yes, always. That's required — for billing, for the accountability agreement we sign with you, and so there's a real party who can respond if anything is ever asked about. What we don't know is who the people you're talking about are — your clients, patients, or filers. Those are two different things, and we don't blur them together. Knowing you as a customer is also handled separately from message content — our identity/billing systems never touch what you actually ask.

Not exactly, and two different techniques are actually doing two different jobs here. Tokenization replaces a sensitive value with an unrelated placeholder (like PERSON_1-C24) before it's ever sent — the real name never leaves your device in any form, encrypted or otherwise. Separately, our own relay runs inside a confidential-computing enclave — hardware-isolated processing, not encryption in the traditional sense — so even our staff can't read the message passing through it. Neither is "encryption" in the classic sense of scrambling data with a reversible key; both work by making sure the wrong party never has readable access in the first place, through different mechanisms.

This describes the architecture we're building toward and piloting with early firms and practices, not a large-scale general-availability product yet. We'd rather be precise about what's designed versus what's fully deployed than imply more is live than actually is.

No. Your device sends the redacted message to our backend, which authenticates to the AI provider under our own business account and forwards it. This is what lets the AI provider see only our account — never your individual identity or IP address.

The relay runs inside a hardware-isolated environment (a confidential-computing enclave) specifically so ordinary staff and infrastructure can't read message content passing through it. This protects against our own systems — it doesn't extend to the AI provider's servers, which still process the tokenized text to generate your answer.

Your device swaps the tokens back to the real values using a map that only ever exists locally. That map is never sent to us or to the AI provider.

Yes. Even though the architecture minimizes what we ever see, we sign a standard Business Associate Agreement — because being an accountable party is the point, not something we try to avoid.

No, and we wouldn't want it to be. We verify who our customers are and can respond to lawful process if it's ever required. A tool that couldn't do that wouldn't be one a firm or practice could responsibly rely on.

Depends what you mean by "my data," since most of what you'd expect to delete was never collected in the first place. What's real and deletable: your account and identity records (billing, KYC — required for the accountability agreement), usage/billing metadata (timestamps, volume, held for abuse detection), and, if you opt into cross-device conversation sync, the encrypted history blob itself — we can't read it (zero-knowledge, only your device holds the key), but the stored blob is real and we can delete it on request. What's not part of this because it was never held: raw identifying content. Redaction happens on your device and discards the real values immediately — there's no pile of your clients' names sitting somewhere waiting to be purged.

AWS Nitro Enclaves — a hardware-isolated compute environment built into supported Amazon EC2 instances. AWS has independently affirmed there is no mechanism for its own operators to access what runs inside the Nitro System, and it's backed by AWS's published Service Terms, not just our own claim. Worth being upfront about the tradeoff: naming a specific vendor here means part of our reliability and security posture is tied to AWS's own — the same way it would be for any company built on major cloud infrastructure. If that ever changes, we'll disclose it.

No — those handle visit transcription and note generation. This covers everything else you already do in ChatGPT or Claude: case summaries, patient education material, prior-auth letters, research. Different job, same underlying need to keep identifying details out of it.

Structured data — emails, phone numbers, SSNs, card numbers — is caught reliably. Names and addresses in messy, real-world text are best-effort, not guaranteed 100% of the time. We're upfront about this rather than promising perfection.