We build AI features into software that handles personal and confidential data, and we design the infrastructure under them to keep that data in the jurisdictions where it has to stay.
Based in Vancouver, BC. Shipping production software since 2011.
Your counsel or compliance team decides which rules apply to you. These are the questions we would ask so the system can be built to their answers.
The right one depends on what your regulator requires and who you need to protect the data from.
You pick a regional deployment, sign the Data Processing Agreement and a Business Associate Agreement where one applies, and document the risk you accept. It can be enough when your regulator accepts contractual controls and your compliance team has signed off on the risk that remains.
Services like Azure OpenAI provisioned throughput and Amazon Bedrock dedicated throughput run on reserved capacity, isolated from other tenants. The provider's jurisdiction stays the same as with the shared API.
Some regional cloud providers host open-weight models behind an API on domestic servers. That keeps data in the country without buying hardware, though a provider with a foreign parent still answers to its home jurisdiction.
You own the servers, the models, and the network, run by a domestic entity. It means buying GPUs, paying for a facility, and keeping a team to run it. We have run self-hosted blockchain nodes across Canada and Europe for several years, and our team can travel on-site to install and configure hardware.
A system can also mix these and send each task to the model that fits it.
Secured significant seed funding through private equity & Techstars
This was a concept-to-production engagement that produced a pitch deck, MVP, and the eventual product. The MVP attracted private investment and the platform later joined Techstars with additional seed funding.
Case studyCrystal aOS is an AI legal compliance platform for crypto law firms. We built it from concept and pitch deck through to production. Legal teams search a curated library of regulatory documents and get answers with citations, and they build their own compliance assessments with human approval steps. Firms manage permissions per matter. Crystal aOS is live with ISO/IEC 27001:2022 and SOC 2 Type 1 certifications.
“Graham moved us from playing with AI to production system in days. The capabilities are amazing but care in how he set us up was even better. The solution is persistent but respects privacy.”
Choose a slot in the booking calendar.
Say what you want AI to do and where your data is allowed to go, and we will say whether we can help.
If we are a fit, we map the problem, the users, the data, and how success is measured. Some projects need AI less than expected, and we tell you which applies before any code is written.
That depends on your rules and on the plan you are on. Under HIPAA, a provider that receives health data in a prompt has to sign a Business Associate Agreement, and some providers' default API access is not covered by one. In the EU, sending personal data to an AI API outside the EEA needs a valid transfer mechanism and a Transfer Impact Assessment. Your counsel or compliance team decides what applies to you.
Not always. PIPEDA does not currently require data to stay in Canada, the GDPR and UK GDPR do not require it to stay in the EU or UK, and HIPAA says nothing about location. They set conditions on transfers and on the companies that handle the data, and some rules add steps. Quebec's Law 25, for example, requires a Privacy Impact Assessment before personal information leaves Quebec.
A local datacentre meets residency. When the provider has a US parent, the CLOUD Act can still reach the data, and holding your own encryption keys does not fully close that gap because the provider still holds metadata and logs. Whether that risk is acceptable depends on how your data is classified and what your regulator requires.
Running your own model keeps the data on hardware you control, and it costs GPUs, a facility, and people to keep it running. At low or bursty volume, idle hardware can cost more than API fees, and our guide suggests proving a use case on a cloud API first. The leading proprietary models also report higher benchmark scores on the hardest reasoning tasks. Before you decide, we can run a sample of your real prompts through both and compare the answers.
You do. We deliver the source code, infrastructure-as-code, and documentation, with no proprietary framework you would need us to maintain.
