# Super Chain — full site text > Every page of https://www.super-chain.tech as markdown. Index: https://www.super-chain.tech/llms.txt --- # Super Chain — Private AI for Family Offices, On Your Own Servers > Super Chain is a private AI platform for family and investment offices that runs on your own infrastructure: grounded answers over your own documents. Source: https://www.super-chain.tech/ Last modified: 2026-10-22 # Superintelligence for the *investment* office. Private AI on your own servers, for the office that holds the ledger. *Nothing leaves the room.* Start the 30-Day Pilot How we work [what "private" actually means →](https://www.super-chain.tech/private-ai-for-family-offices) portfolio.acme-capital · q4-2026 aum $381.4M ▲ 4.1% qtd dpi · q4 1.42× ▼ 0.08 vs plan ###### nav · 12-week study · the office PRINCIPAL a platform principal Total exposure in Swiss francs across the vehicles, please. And the Monaco property — is the *Taxe Foncière* handled this year? SUPER CHAIN private intelligence · cited · in-room // composing the answer → Reading the ledger · holdings denominated in CHF → Translating to USD · spot rates, this morning → Reviewing properties · Monaco · obligations → Citing the documents · 11 sources CHF exposure is **CHF 38.2M** — approximately **$42.6M** at this morning's rate — held across the Geneva private banking line, two Helvetia trust arrangements, and one direct equity position. The Monaco *Taxe Foncière* is paid (March 14); the *Taxe d'Habitation* falls due in twelve days. Mr Ledoux has been notified. CHF · steady Monaco · 12 days 11 sources, all cited FX · this morning ask, in your own words skills · in your office ● Quarterly residency review running · 38s ● Property obligation calendar awaiting principal ● Fund report concierge scheduled · 06:00 ● IC memo first draft complete · 2 min ago — composed by our studio, performed for your office — data egress zero *bytes* jurisdictions multi *by design* deployment your *infrastructure* we listen first always *privately* the agent · in your office ## The AI operating system for family offices. *Ask in your own words.* composing across 14 sources ⌘K > ask, in your own words… ⌘ ↵ What's our total exposure in Swiss francs across all vehicles? // exposure · cross-vehicle When does the Monaco Taxe Foncière fall due this year? // properties · obligation Which lenders fit the Kensington case, and at what terms? // lending · matched Draft a Q3 board memo in our usual house style. // composition · in your tone capabilities ## Everything your office holds, *answering as one.* // 01 ### Dashboard *Intelligence* NAV, allocation, liquidity and currency exposure, updated as statements arrive. live NAV FX exposure benchmarks // 02 ### Document *Intelligence* Statements, deeds and filings, [read down to the footnote and cited to the page](https://www.super-chain.tech/ai-document-intelligence-for-family-offices). It also [tracks the obligations you owe](https://www.super-chain.tech/ai-covenant-obligation-tracking). VLM-read tables · charts cited // 03 ### Portfolio *Intelligence* Drift, concentration and performance, ranked by what needs attention. drift watch advisory // 04 ### Multi-*Jurisdiction* Day counts, property taxes and residency for every member. 88% of family offices hold bankable assets in two or more jurisdictions (source: [UBS Global Family Office Report](https://www.ubs.com/global/en/media/display-page-ndp/en-20260528-global-family-office-report-2026.html), May 2026). day count tax cycle // 05 ### Asset & *Obligation* Every property, loan and covenant in one ledger, flagged before it falls due. covenants renewals // 06 ### Knowledge *Profile* Your trusts, SPVs and holding companies, plus the house glossary and rules only your office knows. house glossary entity registry house rules // 07 ### Deal *Pipeline* Origination to exit, with cited IC memos you edit before anyone sees them. DD trail IC memo cap-call calendar // 08 ### The *Agent* One on-premise AI across all of the above. Nothing leaves your network. Start the 30-Day Pilot who we serve ## One platform, *three kinds of office.* // the family office ### Family *Office* Properties, trusts, people and every document, answerable in plain words. > how many UK days has the principal used this tax year? // the investment office ### Investment *Office* Funds, covenants and the deal pipeline, every answer cited to the page. > which holdings have a covenant maturing in 60 days? // the broker agency ### Broker *Agency* Cases, clients and lenders in one room, terms matched and files audit-ready. [AI for mortgage brokers →](https://www.super-chain.tech/ai-for-mortgage-brokers) > which lenders fit this case, and at what terms? fully customised ## Built for your office, *not off the shelf.* Every deployment is configured to the client, down to the model it runs. // 01 ### Your roles Your titles and permissions, not a fixed admin/user split. // 02 ### Your workflows Skills written for your routines, in your house style. // 03 ### Your documents Extraction tuned to your statements, deeds and term sheets. // 04 ### Your pipeline Your deal types, stages and review rules. // 05 ### Your systems Connected to the tools you already run. // 06 ### Your model The AI model and hosting your IT team chooses. the product ## Quiet software, *seen for a moment.* dashboard · the morning glance how we work ## Live in *four* quiet steps. We do the implementation, not your team. ##### 01 · introductions A first conversation In person where we can. Listening before speaking. ##### 02 · the inventory We map the office Vehicles, members, properties, advisors. ##### 03 · the deployment On your infrastructure Private cloud or your data centre. ##### 04 · it compounds Quietly, week by week Each document read, each rule learned. first conversation → inventory of the office → private deployment → go-live → it compounds skills · a fully-managed routine ## A standing routine, *quietly* run on your behalf. Each Skill waits for an event, such as a statement reconciled or an agreement signed, and drafts what should arrive next. triggered on each new statement reconciled ### Cashflow *forecast* Rebuilds the next ninety days of cash. A memo arrives only when the picture has materially shifted. what arrives From — the studio Q3 statement · reconciled Cashflow update — material shift detected After this morning's custody reconciliation, the next ninety days have shifted. *The Hyperion call has moved forward* by eleven days. *Distributions from Auriga III* arrive ahead of plan, easing September's draw. The household tax liability is now visible. in production tuned to your house we maintain it triggered on a signed agreement uploaded ### Obligation *onboarding* Reads the agreement cover to cover, posts every obligation to the calendar and flags conflicts. what arrives For — the partner's review draft · awaiting confirmation New obligations — Hyperion Series C Eleven obligations have been read out of the signed agreement. *The first cap call* is dated 14 June. The five-year lock-up is now on the calendar. *One conflict* was found — the audit deadline overlaps with the existing Auriga close window. in production your style, your tone never published without you we design them ✦ we operate them ✦ you read what arrives roles & access ## Composed for the way the office *is composed.* Each person sees only what is theirs to see. i THE PRINCIPAL PRINCIPAL ii THE PARTNERS RUNS THE BOOK iii THE ADVISORS COUNSEL iv THE OPERATORS THE WORK v THE COUNTERPARTIES ON BUSINESS #### THE PRINCIPAL // the principal · the keeper of the house See the whole house unrestricted Speak with the platform in plain words Sign off, decline, defer without ceremony Decide who else may enter your call // shaped to your house, not ours tailored on engagement → ## Built quietly, *kept that way.* - i **Sovereign.** Your environment, your data, your keys. - ii **Quiet.** No telemetry, no training on your data. - iii **Discreet.** We keep no documents and never name our clients. - iv **Auditable.** Every question and edit, in a record you own. // our standing commitment We do not retain your documents. We do not train on your house. We do not share that you are a client. —  You are not on our website, and we like it that way. no telemetry no third-party sharing no training on your data [how the architecture answers it →](https://www.super-chain.tech/trust) asked, plainly answered ## Private AI for the office, *in plain answers.* Written by [Cat Yung](https://www.super-cat.tech/cat-yung), Founder, Super Chain. Last updated 22 October 2026. ### What is private AI for a family office? Private AI for a family office is an AI platform deployed inside infrastructure the office controls — its own network or a private tenancy — so documents, portfolio data and conversations never reach a third-party model provider. Super Chain runs this way: nothing leaves the room. ### Can AI track covenants and obligations for an investment office? Yes. Super Chain reads every signed agreement cover-to-cover and posts each obligation it carries — cap calls, lock-ups, renewals, filing windows and covenants — to one calendar, surfacing what is due before it lands rather than after. ### Are there AI tools for mortgage brokers and lending cases? Yes. For a broker agency, Super Chain keeps cases, clients and lenders in one room — matching terms to a case, drafting term sheets, and keeping files audit-ready, with counterparties invited only as far as the specific case allows. ### Can Super Chain be customised for our office? Yes, in depth. Each deployment is configured per client: its own roles and permissions, workflows written for its routines, document extraction tuned to its paperwork, its own deal types and stages, connections to the systems it already uses, and the AI model it chooses. ### Where does the office’s data go? Nowhere. The model, documents, embeddings and audit trail all run on the office’s own servers or a private tenancy its IT team controls. Super Chain keeps no copy and receives no telemetry. further reading — [the four tiers of "private AI" →](https://www.super-chain.tech/private-ai-for-family-offices) · [best AI platform for family offices →](https://www.super-chain.tech/best-ai-platform-for-family-offices) · [AI covenant and obligation tracking →](https://www.super-chain.tech/ai-covenant-obligation-tracking) · [AI document intelligence →](https://www.super-chain.tech/ai-document-intelligence-for-family-offices) · [is ChatGPT safe for family office data →](https://www.super-chain.tech/is-chatgpt-safe-for-family-office-data)✦ [on-premise AI for wealth management →](https://www.super-chain.tech/on-premise-ai-for-wealth-management) // the next step ## The 30-Day Office Memory Pilot We load one vehicle’s documents onto a dedicated, isolated deployment hosted by Super Chain, with an enterprise model API. Your team asks real questions of them for 30 days, and each answer comes back cited to the page it came from. Production deployments run on-premise, on the office’s own infrastructure. Choose a time below to scope the pilot with us. If you would rather see the platform first, [book a private demonstration](https://calendly.com/super-chain/catyung?utm_source=super-chain.tech&utm_campaign=private-demonstration&utm_content=home). [Open the scheduler →](https://calendly.com/super-chain/catyung?utm_source=super-chain.tech&utm_campaign=office-memory-pilot&utm_content=home) --- # Insights — Super Chain > Guides for family offices, investment offices and broker agencies on private AI: where the model runs, what to ask a vendor, and when on-premise matters. Source: https://www.super-chain.tech/insights Last modified: 2026-10-22 insights # Notes for the office that holds the ledger. Nine guides, written for principals and the people who advise them, on the questions worth settling before any AI touches the family’s documents: where the model runs, who can reach the data, and when the convenience of someone else’s data centre stops being worth it. *Read them in any order.* Written by [Cat Yung](https://www.super-cat.tech/cat-yung), Founder, Super Chain. Last updated 22 October 2026. // 01 ## What "private AI" actually means for a family office → The four tiers of AI privacy, the honest trade-offs of each, and the only one where nothing leaves the room. // 02 ## The best AI platform for a family office → Seven platforms scored on the axis every vendor listicle omits, where the model runs, including when a cloud platform is the better fit. // 03 ## On-premise AI for wealth management → When cloud AI is enough, and the 2026 SEC, Reg S-P and SFC developments that move it in-house. // 04 ## AI document intelligence for the family office → How the office’s statements, deeds and side letters are read, extracted and answered from, with the source page cited. // 05 ## Tracking the obligations an investment office owes → Capital calls, LP reporting commitments, side-letter terms and co-investment conditions: the other side of covenant monitoring. // 06 ## Is ChatGPT safe for family office data? → When a hosted assistant is a reasonable choice, when the family’s documents need a different home, and four questions to settle before anyone uploads. // 07 ## How to protect family office data when using AI → Five controls, in order: custody, scope, access, audit and vendor terms, with who in the office owns each. // 08 ## A cyber-safe AI roadmap for family offices → Five decisions, taken in order, from an inventory of the tools staff already use to an audit log the office reads. // 09 ## AI tools for mortgage brokers and lending cases → The tools a broker can buy, sorted by whose data each one touches, and case-file intelligence that stays in the building. On hiring AI engineers, RAG and securing agents, see the [Super Cat guides](https://www.super-cat.tech/guides) by the same team, and its [production case studies](https://www.super-cat.tech/portfolio). // the next step ## The 30-Day Office Memory Pilot We load one vehicle’s documents onto a dedicated, isolated deployment hosted by Super Chain, with an enterprise model API. Your team asks real questions of them for 30 days, and each answer comes back cited to the page it came from. Production deployments run on-premise, on the office’s own infrastructure. Choose a time below to scope the pilot with us. If you would rather see the platform first, [book a private demonstration](https://calendly.com/super-chain/catyung?utm_source=super-chain.tech&utm_campaign=private-demonstration&utm_content=insights). [Open the scheduler →](https://calendly.com/super-chain/catyung?utm_source=super-chain.tech&utm_campaign=office-memory-pilot&utm_content=insights) --- # Private AI for Family Offices: The 4 Tiers of AI Privacy > What "private AI" really means for a family office — the four privacy tiers, honest trade-offs, and the only one where nothing leaves the room. Source: https://www.super-chain.tech/private-ai-for-family-offices Last modified: 2026-10-22 a definition, plainly given # What *"private AI"* actually means for a family office. The word is being diluted. Across AI vendors, "private" can mean anything from an isolated cloud tenant to a promise not to keep your prompts. A family office deserves a precise definition, which Super Chain gives here, and a straight answer to the only question that matters: *where does our data go?* four tiers of privacy · one honest answer · written for the office, not the vendor Written by [Cat Yung](https://www.super-cat.tech/cat-yung), Founder, Super Chain. Last updated 22 October 2026. ## // the definition Private AI, for a family office, is deployment — not policy. The model, the documents, the embeddings and the audit trail run inside infrastructure the office controls, so the answer to *"where does our data go?"* is *"nowhere."* Everything short of that is a weaker word wearing the same name. the privacy ladder ## Four tiers of “private,” *and only one keeps the data home.* Each rung is sold, somewhere, as "private AI." What separates them is not the marketing; it is where the documents physically go and who can reach them. | Tier | Where the data sits | Who can access it | What to watch | | --- | --- | --- | --- | | tier i The public model | Staff paste questions — and sometimes documents — into a consumer chatbot. It is where most offices quietly are today. | The chatbot provider, which may retain and review inputs. | Inputs may be used to improve the model. For a family office, this tier is an incident waiting to be written up. | | tier ii The private cloud tenant | Your own instance of the software, isolated from other customers, running in the vendor’s cloud. | The vendor, whose administrators run the machines. | Isolation is at the application layer only. "Private" here describes the tenancy, not the walls. | | tier iii The zero-retention API | A cloud model reached under a contract that promises your prompts and documents are not stored and not trained on. | The model provider, bound by a contract not to store or train. | A policy, not architecture. Documents still leave your network. The protection is a sentence you trust, not a wall you can inspect. | | tier iv On-premise | The model, the documents, the embeddings and the audit trail all run inside infrastructure the office controls — its own servers, or a private tenancy its IT team holds the keys to. | Only the office’s own people, verifiable at its own firewall. | You give up the convenience of someone else’s data centre. Someone must host the machine, and honesty requires saying so. | Super Chain is built at the fourth tier only: private, on-premise AI intelligence for family offices, investment offices and broker agencies — nothing leaves the room. due diligence, answered ## Four questions for any vendor, *and our answers.* Crain Currency’s advice to family offices (2026) is to walk any AI vendor through the chain of custody: who the model provider is, where it is hosted, the vendor’s relationship with that provider, and the protocols in place. Here is that walkthrough, answered by Super Chain. // who’s the model provider Per-org LLM configuration: the office holds its own provider credentials, not a fixed third party we’ve quietly wired in. // where is it hosted Your infrastructure — private cloud or on-premise. Not our data centre, not a shared multi-tenant cluster. // what’s the vendor’s relationship with that provider None to disclose. We don’t resell access to a model provider on your behalf — you configure and hold the credentials. // what are the privacy and protection protocols Role-based access control down to the document and skill level, per-org isolation, and an audit trail — OpenTelemetry traces and logging — for every action taken. Crain Currency’s advice exists because most vendors can’t answer these cleanly. We just did. [source: Crain Currency — family offices assess risks and rewards of AI investments, 2026 →](https://www.craincurrency.com/family-office-management/family-offices-assess-risks-and-rewards-ai-investments) [For offices whose staff already use ChatGPT: is ChatGPT safe for family office data →](https://www.super-chain.tech/is-chatgpt-safe-for-family-office-data) inside the walls ## What it does, *inside the walls.* Privacy is the precondition, not the product. Once deployed, Super Chain answers only to the people you trust. // 01 ### Document intelligence Fund statements, trust deeds, tax filings, handwritten valuations — read cover-to-cover and made answerable in plain words, with citations to the page. // 02 ### Obligations & covenants Every cap call, lock-up, renewal, filing window and covenant in one calendar — surfaced before it lands, never after. // 03 ### Portfolio & entity queries NAV, allocation, exposure by currency and jurisdiction; trusts, foundations, SPVs and holding companies — asked about in a sentence, answered from the ledger. // 04 ### The office’s own knowledge The house glossary, the standing rules, the way your office writes. Conversational access to what your office knows — and only your office. who it is for ## Who is private AI for, *and who can skip it?* The discreet or regulated office whose documents should never sit on machines someone else administers. An office with a lower sensitivity threshold or no in-house IT team may be better served by a cloud platform; the [platform comparison](https://www.super-chain.tech/best-ai-platform-for-family-offices) sets out when. the honest trade-off ## What does private AI *cost the office?* Historically: weaker models, hand-tended infrastructure and an IT burden the office never asked for. Two things have changed, and one has not. - i **The model gap has closed.** Open-weight models now clear the institutional quality bar. "Staying private means a weaker model" is no longer a trade — it is an excuse past its date. - ii **The burden can be absorbed.** Super Chain arrives appliance-style: we deploy it, tune it and operate it inside your infrastructure. Your IT team holds the keys; ours carries the toolbox. - iii **What remains true.** You forgo the convenience of someone else’s data centre, and updates arrive on your schedule, not silently overnight. Offices at this tier consider that a feature. // read next On-premise AI for wealth management → What tier four looks like in practice — deployment, auditability and the workflows it carries. See the honest platform comparison → Seven platforms scored on the axis every vendor listicle omits: where the model runs. The same problem in lending cases → A broker’s case file carries the same exposure as a private client document. The tools sold to brokers do not. "Does it train on our data?" → The question every office asks, answered by architecture rather than policy. tier iv no telemetry no training on your data private AI, in eight questions ## Eight questions, *plainly answered.* In July 2026, Squire Patton Boggs’ white paper “Managing Family Offices’ AI Risk” named confidentiality and discretion as the sector’s defining constraint on AI adoption. Citigroup’s own May 2026 report on AI in the family office frames the same problem as institutional rigor, not just risk-avoidance — the same conclusion, from the other side of the deal table. [source: Family Wealth Report — Managing Family Offices’ AI Risk (SPB White Paper, Jul 17 2026) →](https://www.familywealthreport.com/article.php/--Managing-Family-Offices%27-AI-Risk-%E2%80%93-SPB-White-Paper?id=208280) [source: Citigroup — “AI in the Family Office: Privacy, Efficiency and Institutional Rigor,” May 2026 →](https://www.citigroup.com/rcs/citigpa/storage/public/ai_in_the_family_office.pdf) ### What is private AI for a family office? Deployment, not policy. The office’s documents, portfolio data and conversations never leave infrastructure it controls, ideally its own network, so no third-party model provider receives, stores or trains on the family’s data. ### What are the four tiers of AI privacy? Public model, private cloud tenant, zero-retention API, and on-premise. The first three still send your data to infrastructure someone else administers; only the fourth — running inside the office’s own network — makes the answer to “where does our data go?” actually “nowhere.” ### Is on-premise private AI worth the trade-off? For a discreet or regulated office, yes. Open-weight models now match the institutional quality bar, so privacy no longer costs capability, and an appliance-style deployment absorbs the IT burden. What you forgo is the convenience of someone else’s data centre — which offices at this tier treat as a feature. ### What can a family office actually do with private AI? Super Chain offers document intelligence over statements, deeds and agreements; obligation and covenant tracking; portfolio and entity queries across every vehicle; and conversational access to the office’s own knowledge — all running inside the office’s own network, answerable to the people it trusts. ### What should a family office ask an AI vendor about data custody? Ask who the model provider is, where it is hosted, the vendor’s relationship with that provider, and the privacy protocols in place. Super Chain’s answers: the office holds its own provider credentials, hosting is the office’s own infrastructure, there is no undisclosed provider relationship, and access runs on per-document, per-skill RBAC with a full audit trail. ### Does Super Chain train on a family office’s data? No. Super Chain runs inside the office’s own infrastructure, so its documents are never sent to Super Chain or to a model provider that could train on them. The office holds its own model-provider credentials, and every question and answer is recorded in an audit trail that the office’s own IT team can inspect. ### Is ChatGPT safe for family office data? It depends on what the office puts in and what it has signed. As of October 2026, any hosted ChatGPT plan processes prompts and attachments on OpenAI’s servers; the plan sets the contract terms, not where the processing happens. Super Chain takes another route for family office data: it runs on infrastructure the office controls, private cloud or on-premise. ### What is the difference between a closed AI system and public AI for a family office? A public AI tool is shared: the office sends prompts to a provider’s service and accepts its terms. A closed system is deployed for one office alone, with its own access rules and audit trail. As of October 2026, Super Chain is a closed system, isolated per office and run on the office’s own private cloud or on-premise servers. // the next step ## The 30-Day Office Memory Pilot We load one vehicle’s documents onto a dedicated, isolated deployment hosted by Super Chain, with an enterprise model API. Your team asks real questions of them for 30 days, and each answer comes back cited to the page it came from. Production deployments run on-premise, on the office’s own infrastructure. Choose a time below to scope the pilot with us. If you would rather see the platform first, [book a private demonstration](https://calendly.com/super-chain/catyung?utm_source=super-chain.tech&utm_campaign=private-demonstration&utm_content=private-ai-for-family-offices). [Open the scheduler →](https://calendly.com/super-chain/catyung?utm_source=super-chain.tech&utm_campaign=office-memory-pilot&utm_content=private-ai-for-family-offices) --- # Best AI Platform for Family Offices: The Honest Comparison > The best AI platform for a family office depends on where your data must live. An honest comparison of cloud and on-premise AI, and where Super Chain fits. Source: https://www.super-chain.tech/best-ai-platform-for-family-offices Last modified: 2026-10-22 a comparison, honestly scored # The best AI platform for a family office. Every "best platform" list in this category was written by one of the platforms on it. So read this one knowing Super Chain is on it too — and that it puts the one column the others leave out at the front: *where does the model actually run?* seven platforms · one omitted axis · the concession the others won’t print Written by [Cat Yung](https://www.super-cat.tech/cat-yung), Founder, Super Chain. Last updated 22 October 2026. ## // the short answer It depends on the one question every vendor listicle skips: where does the model run? Cloud platforms (Aleta, Masttro, Asseta, Sage) trade control for convenience; Super Chain runs entirely on the office’s own infrastructure. That omission is not an accident. Every incumbent in this category is cloud SaaS, so naming deployment location as an axis would indict its own architecture. cloud vs on-premise ## Seven platforms, *scored on where they run.* Deployment model is the row we can publish honestly for every vendor, because it is a matter of architecture rather than opinion. The three feature columns stay blank for competitors on purpose: we have not verified them against each vendor’s own site, and we would rather show a dash than a flattering guess. The closest thing to a neutral list, [Forbes’ annual family office software roundup](https://www.forbes.com/sites/francoisbotha/2025/11/09/the-2025-family-office-software--roundup/) (Forbes, November 2025), is not vendor-written, and it does not score deployment location either. | Vendor | Deployment model | Document intelligence | Covenant / obligation tracking | Audit trail | | --- | --- | --- | --- | --- | | Aleta | Cloud SaaS | — | — | — | | Masttro | Cloud SaaS | — | — | — | | Asseta | Cloud SaaS | — | — | — | | Eton Solutions (AtlasFive) | Cloud SaaS | — | — | — | | Addepar | Cloud SaaS | — | — | — | | FamilyOfficer.com (VDR.ai) | Cloud SaaS | — | — | — | | Super Chain | On-premise / private tenancy | Yes — OCR + VLM extraction | Yes — obligation & key-date extraction | Yes — traces, metrics, audit logging | Private, on-premise AI intelligence for family offices, investment offices and broker agencies — nothing leaves the room. the honest concession ## When does cloud AI *make sense* for a family office? Often. A comparison that only flatters the vendor who wrote it is just another rigged listicle, so here is the case against us, made properly. There are three offices we would send to a cloud platform without hesitating. // 01 ### A lower sensitivity threshold If the office’s documents would not embarrass anyone in a subpoena, the convenience of a hosted platform is worth more than the walls. // 02 ### Fastest time-to-value A cloud tenant is live the afternoon you sign. A private deployment is measured in weeks, because someone has to stand up the machine. // 03 ### No in-house IT A private deployment needs a team that holds the keys. Offices without one are better served by a vendor who carries the whole burden. who it is for ## Who on-premise suits, *and who should look elsewhere.* The family or investment office that has decided its documents do not leave its own network, and that has, or can hire, an IT team to hold the keys. An office that needs to be live this week, or has no infrastructure of its own, is better served by a cloud platform from the table above. the checklist ## Five questions *to put to every vendor.* Super Chain included. Where the model runs and who can see the data come first; features come last, because a platform that fails the first two should not see the office’s documents at all. - i **Where it runs.** Vendor cloud, a private tenant, or the office’s own infrastructure. See [what “private AI” means](https://www.super-chain.tech/private-ai-for-family-offices). - ii **Whether it trains on your data.** Ask for the architecture, not the policy. See [how to verify it doesn’t](https://www.super-chain.tech/trust). - iii **Grounded answers with citations.** Every answer should point back to the document it came from. - iv **Access control.** Role-based permissions down to individual documents and workflows, so a junior analyst does not see the principal’s files. - v **An audit trail you hold.** Traces, metrics and an audit log of every question, kept inside the office. where we fit ## Where does *Super Chain* fit? At exactly one point on the map: the office that has decided its documents do not leave its own network, and still wants the work done. The trade-off is a deployment measured in weeks, not an afternoon, and an internal team that holds the keys. - i **The only on-premise row.** Every other platform in the table is vendor-hosted. That is the axis none of them can compete on without rebuilding. - ii **Not an unproven newcomer.** Super Chain’s founder, Cat Yung, is Expert-Vetted on Upwork, a top 1% rating, with a 100% Job Success Score. The founding team’s production AI runs at a 5,000-employee US enterprise and inside a Big 4 firm (source: Upwork profile, October 2026). - iii **What you give up.** The convenience of someone else’s data centre, and a deployment measured in weeks rather than an afternoon. Offices at this tier treat that as a feature. // read next What "private AI" actually means → The four privacy tiers behind the deployment column above — and why only one of them is a wall. On-premise AI for wealth management → What the on-premise row looks like in practice — deployment, auditability, workflows. on-premise no telemetry no training on your data the comparison, in eight questions ## Common questions, *plainly answered.* ### Is there an on-premise option among the top family office AI platforms? Yes, one. Super Chain is the only on-premise or private-tenancy platform in this comparison; every other listed vendor is cloud SaaS. The models, the documents and the audit trail run on the office’s own servers or private cloud, not in a vendor’s data centre. ### Is cloud AI ever the right choice for a family office? Yes. A cloud platform such as Aleta or Masttro can be the right fit for an office with a lower sensitivity threshold, a need for faster time-to-value, or no in-house infrastructure team. A cloud tenant can be live the day you sign, while a private deployment takes weeks because someone has to stand up the machine. ### What does "nothing leaves the room" mean? The models, the data and the audit trail stay inside the office’s own infrastructure. No client data goes to a third-party cloud, each organisation is isolated from every other, and every question and answer is recorded in an audit log the office holds. ### Who is behind Super Chain? Super Chain was founded by Cat Yung, who is Expert-Vetted on Upwork, a top 1% rating, with a 100% Job Success Score (source: Upwork profile, October 2026). The founding team’s production AI includes a 24/7 voice agent for a 5,000-employee US enterprise and an enterprise RAG chatbot inside a Big 4 accounting firm. ### What does Super Chain do inside a family office? Super Chain answers plain-language questions across every vehicle, document and rule the office holds, with citations back to the source documents. It also extracts obligations, financials and key dates from uploaded documents, converts currencies across vehicles and produces reports, all on the office’s own infrastructure and under its own access controls. ### How should a family office compare AI platforms? Start with where the model runs, then compare features. Ask each vendor whether your documents leave your network, who can read them, whether they train on your data, and whether you hold the audit trail. Only then compare document intelligence, obligation tracking and reporting, which every vendor describes in its own flattering way. ### What is an AI operating system for a family office? An AI operating system for a family office is one layer over everything the office holds: vehicles, holdings, documents, obligations and transactions, queried in plain language. As of October 2026, Super Chain works this way. It runs on the office’s own infrastructure and answers from its own records with sources cited, rather than as a chatbot added to one tool. ### Is Super Chain software or an AI consultancy? Super Chain is software. As of October 2026, it is a platform installed on the family office’s own infrastructure, private cloud or on-premise, that answers questions over the office’s documents and holdings with sources cited. It is built by Super Cat Technology, whose team configures each deployment, but the office buys a product it runs, not a strategy engagement. // the next step ## The 30-Day Office Memory Pilot We load one vehicle’s documents onto a dedicated, isolated deployment hosted by Super Chain, with an enterprise model API. Your team asks real questions of them for 30 days, and each answer comes back cited to the page it came from. Production deployments run on-premise, on the office’s own infrastructure. Choose a time below to scope the pilot with us. If you would rather see the platform first, [book a private demonstration](https://calendly.com/super-chain/catyung?utm_source=super-chain.tech&utm_campaign=private-demonstration&utm_content=best-ai-platform-for-family-offices). [Open the scheduler →](https://calendly.com/super-chain/catyung?utm_source=super-chain.tech&utm_campaign=office-memory-pilot&utm_content=best-ai-platform-for-family-offices) --- # On-Premise AI for Wealth Management: Cloud vs In-Network > When is cloud AI enough for a wealth manager, and when does on-premise become mandatory? The honest 2026 decision guide — SEC, Reg S-P and SFC triggers. Source: https://www.super-chain.tech/on-premise-ai-for-wealth-management Last modified: 2026-10-22 the cloud-vs-on-premise decision, answered # On-premise AI for wealth management. AI installed inside the firm’s own network or private tenancy. The models, the data and the audit trail never leave the office, so portfolio, entity and document intelligence runs without sending client data to a third-party cloud. The real question isn’t architecture — it’s a decision: *can we keep using cloud AI, or does our situation force it in-house?* Cloud is genuinely fine — until one of four things becomes true. when cloud is fine · the four 2026 triggers that disqualify it · what on-premise delivers Written by [Cat Yung](https://www.super-cat.tech/cat-yung), Founder, Super Chain. Last updated 22 October 2026. the honest comparison ## Public cloud, private tenant, *in-network.* Three ways to run AI over a wealth operation’s data, compared on the axes that actually decide it. Cloud earns its place for low-sensitivity, scale-on-demand work. The table shows where that stops being true. | decision axis | Public cloud API | Private cloud tenant | On-premise (in-network) | | --- | --- | --- | --- | | Data residency | Vendor’s regions | Vendor’s tenancy | Your network — never leaves | | Third-party vendor exposure | High — data transits the provider | Reduced — still vendor infrastructure | None — no third party in the path | | Audit trail | Vendor attestation | Shared logs, vendor-held | Your own logs, your side of the wall | | Cost model | Metered per query / per seat | Metered plus reserved capacity | Predictable fixed-infrastructure cost — no per-query metering † | | Model quality | Frontier models | Frontier models | Open-weight models now match the bar | | IT control | Vendor-controlled | Shared control | Your team holds network, keys, change windows | † Cloud AI cost models are still being priced live in the market: “the cost gets sorted out later” is now a documented vendor-side vulnerability, not a hypothetical. [source: Modus — “Addepar’s AI Is Already a Hit. The Cost Will Get Sorted Out Later.” (Jun 8 2026) →](https://www.modus.news/addepars-ai-is-already-a-hit-the-cost-will-get-sorted-out-later/) the honest concession ## When is cloud AI *enough* for a wealth manager? Often. For general research, drafting, market summaries and any task that touches no identifiable client data, a public cloud API is the right and lower-cost answer. Cloud stops being enough at one precise line: the moment client identities, holdings, entities or documents enter the prompt, or a regulator expects you to control where that data goes. On-premise is the answer to that second case, not the first. A live example of that trade-off: WealthAi launched a new cloud AI layer for advisers this month, with no rip-and-replace and a reported 60% cut in routine admin time in beta (FinTech Global, September 2026). It is a good answer to “how soon can we adopt.” It is not an answer to “where does the client record go once we do”: on a cloud platform, that is the vendor’s infrastructure, not yours. [source: FinTech Global — WealthAi launches AI platform for independent advisers (Sep 3 2026) →](https://fintech.global/2026/09/03/wealthai-launches-ai-platform-for-independent-advisers/) what changed in 2026 ## When does on-premise become *mandatory?* Four things turned true in 2026, and any one of them moves in-network deployment from a preference to a requirement for a regulated or discreet office. Each is a dated, third-party development, not Super Chain’s claim. // trigger 01 · sec ### AI supervision is now its own SEC exam category The SEC’s 2026 examination priorities name AI use and supervision as a standalone review area for RIAs and broker-dealers. AI oversight is no longer incidental — it is something examiners now arrive expecting to inspect. [source: Akin Gump — SEC Announces 2026 Exam Priorities →](https://www.akingump.com/en/insights/alerts/sec-announces-2026-exam-priorities) // trigger 02 · reg s-p ### Regulation S-P vendor-oversight duties land June 3, 2026 The amended safeguards rule takes effect for smaller entities on June 3, 2026, requiring documented controls over how AI tools and vendors handle client data — including a written incident-response program for a data breach. [source: Holland & Knight — Regulation S-P Compliance Deadline Approaching →](https://www.hklaw.com/en/insights/publications/2026/05/regulation-s-p-amendments-compliance-deadline-approaching) // trigger 03 · sfc ### Hong Kong’s SFC classifies AI investment advice as “high risk” The SFC treats AI-generated investment recommendations and research as high-risk use, imposing stricter model-validation duties — while the EU AI Act’s extraterritorial reach has been flagged to Hong Kong institutions. [source: Freshfields — Hong Kong Financial Regulators Issue Rules on the Use of AI →](https://www.freshfields.com/en/our-thinking/blogs/risk-and-compliance/hong-kong-financial-regulators-issue-rules-on-the-use-of-ai-102jrmt) // trigger 04 · confidentiality ### A top firm codifies confidentiality as the defining AI constraint Squire Patton Boggs’ July 2026 white paper, “Managing Family Offices’ AI Risk”, names confidentiality and discretion as the sector’s defining AI constraint — the plain case for keeping the model inside the office’s own network. [source: Family Wealth Report — Managing Family Offices’ AI Risk (SPB White Paper, Jul 17 2026) →](https://www.familywealthreport.com/article.php/--Managing-Family-Offices%27-AI-Risk-%E2%80%93-SPB-White-Paper?id=208280) the other exposure ## The risk that isn’t *where the data sits.* It is who can be talked into granting access. In August 2026 a coordinated AI-vishing wave targeted Point72, Citadel, Millennium and Two Sigma: callers with cloned executive voices pressed help desks for MFA resets and new-device enrollment (Fortune, August 2026). Nothing was hacked. Someone was called. FINRA activated its Financial Intelligence Fusion Center in response. On-premise deployment doesn’t make a help desk immune to a convincing phone call. What it changes is what that call can reach: minimal standing access, internal logging of every request, and no vendor-side account a caller can talk their way into resetting. [source: InvestmentNews — Point72, Citadel among hedge funds hit by AI vishing attacks →](https://www.investmentnews.com/fintech/point72-citadel-among-hedge-funds-hit-by-ai-vishing-attacks/267708) [source: Tech Times — FINRA Fusion Center activated (Aug 6 2026) →](https://www.techtimes.com/articles/323265/20260806/wall-street-hedge-funds-hit-coordinated-ai-vishing-finra-fusion-center-activated.htm) [source: Fortune — Major hedge funds targeted in wave of attempted cyberattacks (Aug 6 2026) →](https://fortune.com/2026/08/06/major-hedge-funds-targeted-in-wave-of-attempted-cyberattacks/) the objection that expired ## The quality objection *has expired.* Open-weight models now match the institutional quality bar, so keeping the model inside your walls no longer costs you capability. “Staying private means a weaker model” was a real constraint once; today it is an excuse, not a trade. who it is for ## Who needs it, *and who doesn’t?* Any wealth manager, family office or investment office, once client identities, holdings or documents go into the prompt, or once one of the four 2026 triggers above applies. A firm using AI only for research and drafting does not. what is delivered ## What arrives *inside the walls.* Everything below runs on the office’s own servers or private tenancy: not a feature list hosted elsewhere, but Super Chain itself, living where the documents live. It carries a predictable fixed-infrastructure cost with no per-query cloud metering or per-seat cost creep. // 01 ### Document intelligence Fund statements, trust deeds, facility agreements and handwritten valuations — read by vision models and made answerable with citations to the page. // 02 ### Covenant & obligation tracking Cap calls, lock-ups, renewals, filing windows and covenants posted to one calendar, surfaced before they land. // 03 ### Portfolio & entity queries NAV, allocation, liquidity and FX exposure across every vehicle — asked in a sentence, answered from the ledger. // 04 ### Org-scoped access control Principals, partners, advisors, operators and counterparties each see only what is theirs — enforced in the platform, in the words your office already uses. // 05 ### A full audit trail Every glance, edit and question kept in a record that belongs to the office — readable, exportable, yours. *Private, on-premise AI intelligence for family offices, investment offices and broker agencies — nothing leaves the room.* the decision, in seven questions ## Cloud or in-network, *plainly answered.* ### When is cloud AI enough for a wealth manager? Cloud AI is fine for low-sensitivity, scale-on-demand work — general research, drafting and tasks that touch no identifiable client data. It stops being enough the moment client identities, holdings or documents enter the prompt, or a regulator expects you to control where that data goes. ### When does on-premise AI become mandatory? When any of four 2026 triggers applies: the SEC’s new AI exam category, Regulation S-P’s June 2026 vendor-oversight duties, the SFC’s “high-risk” classification of AI investment advice, or a confidentiality standard like the one Squire Patton Boggs codified for family offices. Each makes third-party data transit a liability. ### Is on-premise AI lower quality than cloud AI? No. Open-weight models now match the institutional quality bar, so keeping the model in-network no longer costs you capability. “Staying private means a weaker model” is an outdated trade-off, not a current one. The real costs of on-premise are elsewhere: a deployment measured in weeks, and an internal team that holds the keys. ### What does on-premise AI for wealth management actually deliver? It delivers document intelligence, obligation and covenant tracking, portfolio and entity queries, org-scoped access control and a full audit trail, all running inside the office’s own network or private tenancy. The cost is a predictable fixed-infrastructure cost, with no per-query cloud metering or per-seat cost creep. ### Is Super Chain an on-premise AI platform for wealth managers? Yes. Super Chain runs on the office’s own servers, or in a private tenancy its IT team holds the keys to, for family offices, investment offices and broker agencies. It answers questions over the office’s own documents with citations, tracks obligations and key dates, and keeps an audit log of every request inside the office. ### Does on-premise AI protect against social-engineering attacks like the 2026 hedge-fund vishing wave? Not by itself — no architecture stops a convincing phone call. What it changes is the blast radius: minimal standing access, no vendor-side account to reset, and a full internal log of every request, inside the office’s own network rather than a vendor’s help desk. ### What should a self-hosted AI assistant for private wealth include? Super Chain’s view, as of October 2026, is four things. The firm runs it on its own servers or private cloud. Answers are grounded in its documents, with the source cited. Access is set by role down to the single document, and the firm keeps an audit log. Without the last two, self-hosting moves the risk rather than reducing it. further reading — [the four tiers of “private AI” →](https://www.super-chain.tech/private-ai-for-family-offices)✦ [“does it train on our data?” →](https://www.super-chain.tech/trust) · [on-premise AI for mortgage brokers →](https://www.super-chain.tech/ai-for-mortgage-brokers) · [a cyber-safe AI roadmap for family offices →](https://www.super-chain.tech/cyber-safe-ai-roadmap-for-family-offices) // the next step ## The 30-Day Office Memory Pilot We load one vehicle’s documents onto a dedicated, isolated deployment hosted by Super Chain, with an enterprise model API. Your team asks real questions of them for 30 days, and each answer comes back cited to the page it came from. Production deployments run on-premise, on the office’s own infrastructure. Choose a time below to scope the pilot with us. If you would rather see the platform first, [book a private demonstration](https://calendly.com/super-chain/catyung?utm_source=super-chain.tech&utm_campaign=private-demonstration&utm_content=on-premise-ai-for-wealth-management). [Open the scheduler →](https://calendly.com/super-chain/catyung?utm_source=super-chain.tech&utm_campaign=office-memory-pilot&utm_content=on-premise-ai-for-wealth-management) --- # Family Office Software with AI Document Intelligence > Super Chain reads a family office’s statements, deeds and side letters. It extracts figures and dates and answers questions cited to the page, on your own infrastructure. Source: https://www.super-chain.tech/ai-document-intelligence-for-family-offices Last modified: 2026-10-23 document intelligence # AI document intelligence for the family office. Super Chain is family office software that reads the documents the office already holds: custodian statements, deeds, side letters and capital-call notices. It answers questions about them *with the source page cited.* It runs on infrastructure the office controls: its own private cloud or on-premise servers. read once · asked in plain words · cited to the page Written by [Cat Yung](https://www.super-cat.tech/cat-yung), Founder, Super Chain. Last updated 23 October 2026. the reading ## Read once, *answerable from then on.* Most of what a family office knows sits in documents nobody has time to reread. Super Chain reads them as they arrive and keeps them ready for the next question. // 01 ### Read Scanned and digital documents are read with OCR and vision-model extraction, so a scanned deed and a native statement are handled alike. // 02 ### Classify and summarise Each document is sorted by type and condensed into a short summary, for the person who needs the gist before the meeting. // 03 ### Extract Obligations, financial figures and key dates are pulled out of the text, so they can be reviewed and tracked instead of retyped. // 04 ### Ask Anyone with access can ask in plain language across every document, vehicle and rule the office holds. Each answer is cited to its page. two approaches ## Data in a dashboard, *or answers from the archive.* Most wealth platforms that add document AI use it to lift figures from statements into a reporting dashboard. That saves keying, and for performance reporting it is the right tool. Super Chain is built for the other half of the work: the question that needs the document itself. Which side letter carries a transfer restriction, what a trust deed says about distributions, when the next call falls due. The answer comes back in plain words, with the page it came from. who it is for ## Who it suits, *and who it doesn’t.* Single and multi-family offices, and investment offices, whose knowledge sits in fund documents, agreements, statements and correspondence spread across vehicles and advisers. It suits an office where a principal or COO asks questions that today cost someone an afternoon in the files. It is not for an office whose only need is consolidated performance reporting. A reporting platform with document capture will serve that better. delivery ## How it is put in place, *and who does what.* - i **Scope.** The office names one owner and chooses the first vehicle or document set. The pilot runs on a dedicated, isolated deployment we host; together we agree where production will run: the office’s private cloud or its own servers. - ii **Deploy.** Our team installs Super Chain on that infrastructure and configures roles, permissions and document extraction for the office’s own paperwork. - iii **Load and check.** The office uploads a representative set of documents, not a tidied sample. We review the extraction with the owner against the cited pages. - iv **Use.** Staff ask questions in plain language. Every query is recorded in an audit log the office holds. Super Chain is accountable for the platform and its configuration. The office remains accountable for which documents go in and who may see them. // what can go wrong - The archive is thinner or messier than expected.** We check a real sample first and tell the office what it supports. - No owner inside the office.** We pause until one person can decide. - Access and security review take longer.** We list what is needed at the start and raise blockers the day they appear. - Daily use differs from the pilot.** We measure on the office’s real questions and report the numbers as they are. - Some documents must stay in-house under the office’s policy.** We scope the deployment to that policy before any document moves. // track record Super Chain is built by Super Cat Technology. The same team built a [fully on-premise retrieval system for a Big 4 firm](https://www.super-cat.tech/portfolio/enterprise-rag-big-4), where every answer returns with its source paragraph. Extraction is only as complete as the documents behind it. A term that was never written down, or a file the office never uploaded, cannot be found. Every extracted figure is cited, so a person can check it before acting. “When a family office asks me what AI can do with its documents, I ask to see the worst file first. That is usually an old scan, or a deed nobody has retyped. For one family office, my team built an LLM with retrieval over its research, macro data and holdings, model chosen per office. That work taught us one rule. A figure nobody can trace to its page is a figure nobody should act on.” ## What Cat is seeing *in October 2026.* - October 2026 The first question I hear is where an answer came from, not how fast it arrives. Offices want to open the cited page in the demo, before anything else. - October 2026 Offices want to start with one vehicle’s documents, not the whole archive. A real, messy set from one vehicle tells them more than a tidied sample of everything. - October 2026 Family offices are backing AI as investors faster than they use it in their own operations ([CNBC, 12 October 2026](https://www.cnbc.com/2026/10/12/ai-fomo-driving-some-family-offices-to-ai-investments-survey-suggests.html); [InvestmentNews, 16 October 2026](https://www.investmentnews.com/mergers-acquisitions/family-offices-poured-683b-into-ai-and-ria-deals-in-q3-2026/268624)). The documents behind those deals still sit in folders the office searches by hand. read next ## Where the reading *leads.* Tracking the obligations the office owes → The same extraction, pointed at capital calls, side letters and LP commitments. What "private AI" actually means → The four tiers of AI privacy, and the trade-offs of each. The honest platform comparison → Seven platforms scored on where the model runs. How the architecture is built → Deployment, access and audit, for the office’s IT team. Protecting family office data when using AI → Five controls, in order, before any document reaches a model. four questions ## Four questions, *plainly answered.* ### Which family office software has AI document intelligence? As of October 2026, Super Chain is family office software built around AI document intelligence. It reads the office’s statements, deeds, side letters and capital-call notices with OCR and vision-model extraction, pulls out obligations, figures and key dates, and answers questions with the source page cited. It runs on infrastructure the office controls, private cloud or on-premise. ### Can AI document intelligence show where an answer came from? Yes. As of October 2026, Super Chain answers from the family office’s own documents through grounded retrieval, so each answer carries a citation to the page it came from. A reviewer can open the statement or side letter and read the clause before acting. That check matters most for the figures and dates that feed a decision or a report. ### Can AI read scanned family office documents? Yes, within limits. As of October 2026, Super Chain reads scanned and digital documents with OCR and vision-model extraction, so a scanned deed or an old statement can be classified, summarised and searched alongside native files. Extraction is only as good as the page itself: faint scans and handwriting need a person to check the cited source. ### Where does Super Chain’s document intelligence run? As of October 2026, Super Chain’s document intelligence runs on infrastructure the family office controls. That is a private cloud tenancy or the office’s own on-premise servers, with each office isolated from every other. Access is set by role down to the single document. Every question asked is recorded in an audit log the office holds. To see it read your own paperwork, start the 30-Day Office Memory Pilot → // the next step ## The 30-Day Office Memory Pilot We load one vehicle’s documents onto a dedicated, isolated deployment hosted by Super Chain, with an enterprise model API. Your team asks real questions of them for 30 days, and each answer comes back cited to the page it came from. Production deployments run on-premise, on the office’s own infrastructure. Choose a time below to scope the pilot with us. If you would rather see the platform first, [book a private demonstration](https://calendly.com/super-chain/catyung?utm_source=super-chain.tech&utm_campaign=private-demonstration&utm_content=ai-document-intelligence-for-family-offices). [Open the scheduler →](https://calendly.com/super-chain/catyung?utm_source=super-chain.tech&utm_campaign=office-memory-pilot&utm_content=ai-document-intelligence-for-family-offices) --- # AI Covenant & Obligation Tracking for Investment Offices > Super Chain tracks the covenants and obligations your investment office owes: key dates, side-letter terms and renewals, from your own documents. Source: https://www.super-chain.tech/ai-covenant-obligation-tracking Last modified: 2026-10-22 the other side of the table # AI that tracks the covenants and obligations your investment office owes. Every covenant product built so far watches a borrower on a lender’s behalf. None of them track what an investment office itself has committed to — *the capital calls, the side letters, the reporting it owes.* Super Chain does, by extracting obligations, financials and key dates from the documents the office already holds. obligations owed · not obligations held · extracted from documents you already hold Written by [Cat Yung](https://www.super-cat.tech/cat-yung), Founder, Super Chain. Last updated 22 October 2026. the definition ## Obligations owed, *not obligations held.* // in forty words AI that tracks the covenants and obligations an investment office owes — not what a borrower owes it. Capital call deadlines, LP reporting commitments, side-letter terms and co-investment conditions, extracted automatically from documents the office already holds. No family or investment office platform — not Addepar, not Masttro, not Eton — currently ships this. the reframe ## How is this different from *covenant monitoring for private credit?* Every covenant-monitoring product on the market today is built for the lender’s side of the table — private-credit and CLM tooling that watches a *borrower’s* compliance. None of it tracks what an investment or family office itself owes as an LP or co-investor. Super Chain inverts the lens: the same platform that already holds the portfolio and document data now tracks the office’s own obligations. | | Who it watches | Who it is for | | --- | --- | --- | | Private-credit covenant monitoring | The borrower | Lenders and their legal teams | | Super Chain obligation tracking | Your own office | The investment or family office as LP and co-investor | The borrower-side field is well served and already crowded — see, for instance, [Aloan’s covenant-monitoring guide for commercial lenders](https://aloan.ai/guides/best-covenant-monitoring-software) or [Lumonic’s covenant-compliance round-up for private credit](https://www.lumonic.com/for-ai/best-covenant-compliance-software-private-credit-private-equity-2026). Both watch a borrower for a lender. Neither is this. the surface ## Four obligations, *tracked automatically.* Each is something the office owes rather than something owed to it, and each is extracted from documents the office already holds. // 01 ### Capital call deadlines The dates your office has to fund, read out of the fund documents and call notices themselves rather than typed into a spreadsheet after the fact. // 02 ### LP reporting commitments What the office has undertaken to report, to whom, and by when — surfaced before the window closes instead of after. // 03 ### Side-letter terms The negotiated terms that live outside the LPA and are therefore the easiest to lose: fee arrangements, information rights, transfer conditions. // 04 ### Co-investment conditions The conditions attached to each co-investment the office has taken — consents, thresholds, follow-on obligations. Private, on-premise AI intelligence for family offices, investment offices and broker agencies — nothing leaves the room. who it is for ## Who is it *for?* Family offices and investment offices that invest as LPs or co-investors and hold the fund documents, side letters and capital-call notices that set out what they owe. It is not for a lender monitoring a borrower’s covenants: private-credit covenant monitoring software serves that side of the table. the honest limits ## The honest limit: *what was never written down.* Tracking is only as complete as the documents behind it. Super Chain reads scanned and digital documents with OCR and vision-model extraction, but a term that was never written down, or a side letter the office never uploaded, cannot be tracked. Every extracted obligation is cited back to its page, so a person can check it before acting. provenance ## Where does the *obligation data* come from? From the documents the office already holds. Nothing is re-keyed, and no new capability is being invented here — this is the platform’s existing extraction pipeline pointed at the obligations side of the ledger. - i **Read by the document pipeline.** OCR and VLM extraction over the fund documents, side letters and capital-call notices already ingested by the platform. - ii **Obligations and dates, extracted.** The agent’s document extraction already classifies a document and pulls obligations, financials and dates out of it. - iii **Answerable, with citations.** Grounded retrieval over the office’s own documents, so every obligation can be traced back to the page it came from. - iv **On your infrastructure.** Extraction and tracking run inside the office’s own network or private tenancy — nothing leaves the room. // read next AI document intelligence for the family office → How the documents behind every obligation are read, extracted and cited. What "private AI" actually means → The four privacy tiers — and why only one of them is a wall. The honest platform comparison → Seven platforms scored on the axis every vendor listicle omits: where the model runs. On-premise AI for wealth management → When cloud AI is enough, and the 2026 triggers that make in-network deployment mandatory. "Does it train on our data?" → The question every office asks, answered by architecture rather than policy. on-premise obligation & key-date extraction cited answers six questions ## Six questions, *answered.* ### Does Super Chain track covenants my portfolio owes me, or what my office owes as an LP? Super Chain tracks the obligations side: the capital calls, side-letter terms, LP reporting commitments and co-investment conditions your office owes as an LP or co-investor. That is the gap no family or investment office platform covers today. Borrower-side covenant monitoring, where a lender watches a borrower, is a separate and already crowded category. ### Is this different from private-credit covenant monitoring software? Yes. Private-credit tools such as Aloan or Lumonic watch a borrower’s compliance on behalf of a lender and its legal team. Super Chain looks the other way: it tracks your own office’s commitments and deadlines as an LP or co-investor, from the fund documents and side letters the office already holds. ### Where does the obligation data come from? It is extracted automatically from the fund documents, side letters and capital-call notices already ingested by Super Chain’s document intelligence, which uses OCR and vision-model extraction. The agent classifies each document and pulls out obligations, financials and dates, so there is no separate data entry and no spreadsheet to keep in sync. ### Is any of this document data sent to a third party? No. Extraction and tracking run entirely on the office’s own infrastructure, on its own servers or a private tenancy its IT team controls, so nothing leaves the room. Access is role-based down to the individual document, and every query is recorded in an audit log that the office itself holds. ### How does Super Chain surface an upcoming obligation? Obligations and key dates extracted from the office’s documents sit in one calendar of capital calls, lock-ups, renewals, filing windows and covenants, surfaced before they land. Anyone with access can also ask in plain language, such as which capital calls fall due this quarter, and get an answer cited to the source document. ### Can every obligation be traced back to its source document? Yes. Super Chain answers with grounded retrieval over the office’s own documents, so every obligation it reports carries a citation to the page it came from. A reviewer can open the side letter or call notice and check the exact clause before acting, rather than trusting an unexplained summary. // the next step ## The 30-Day Office Memory Pilot We load one vehicle’s documents onto a dedicated, isolated deployment hosted by Super Chain, with an enterprise model API. Your team asks real questions of them for 30 days, and each answer comes back cited to the page it came from. Production deployments run on-premise, on the office’s own infrastructure. Choose a time below to scope the pilot with us. If you would rather see the platform first, [book a private demonstration](https://calendly.com/super-chain/catyung?utm_source=super-chain.tech&utm_campaign=private-demonstration&utm_content=ai-covenant-obligation-tracking). [Open the scheduler →](https://calendly.com/super-chain/catyung?utm_source=super-chain.tech&utm_campaign=office-memory-pilot&utm_content=ai-covenant-obligation-tracking) --- # Is ChatGPT Safe for Family Office Data? > When ChatGPT is a reasonable choice for a family office, when its data needs a different home, and the questions to settle before anyone uploads a document. Source: https://www.super-chain.tech/is-chatgpt-safe-for-family-office-data Last modified: 2026-10-22 chatgpt and family office data # Is ChatGPT safe for family office data? It depends on what the office puts into it and which plan it has signed. As of October 2026, every hosted ChatGPT plan processes prompts and uploaded files on OpenAI’s servers, under that plan’s terms. For drafting with no client data in it, that is often acceptable. Statements, trust deeds and side letters belong in a tool that runs on infrastructure the office controls. custody first · then terms · then the tool Written by [Cat Yung](https://www.super-cat.tech/cat-yung), Founder, Super Chain. Last updated 22 October 2026. what happens to the document ## What happens to a document *pasted into ChatGPT.* When a member of staff pastes a statement or uploads a side letter, the text travels to OpenAI’s service and is processed there. What happens next is set by the plan: consumer accounts and business plans carry different data terms, and providers revise those terms from time to time. The office’s protection is the contract it signed, and whether staff used the account that contract covers. A business plan does little for a document pasted into a personal account on a phone. when it is reasonable ## When ChatGPT is *a reasonable choice.* Hosted assistants suit general drafting, summarising public material, and rewording a letter with no names in it. The test is simple: nothing in the prompt would matter if someone outside the office read it. Many offices allow that kind of use on an approved business account, with the rule written down. That is a sensible place for a hosted tool. when the data needs a different home ## When family office data *needs a different home.* Documents that carry family names, holdings, tax positions or counterparties are a different matter. A custodian statement, a trust deed or a side letter describes the family as much as the assets. The FCA’s good-practice review of AI in financial services, published on 19 October 2026, describes firms adopting AI systems and architecture that reflect the sensitivity and security requirements of each use case. A family office can apply the same test: match the tool to the document. (Source: [FCA, October 2026](https://www.fca.org.uk/publications/good-poor-practice/ai-financial-services).) before anyone uploads ## Four questions to settle *before anyone uploads a document.* Each answer belongs in writing, with the date it was checked, because provider terms change. - Which plan are staff on?** Check that it covers every account they actually use, including phones and personal logins. - What do the plan’s terms say today?** Read the retention and training terms for that plan, and note the date you read them. - Which documents may never go in?** Name them by type: statements, deeds, side letters, anything naming the family. - Who reviews the terms on renewal?** Give one person the job, and a date in the diary. the other route ## How Super Chain handles *the same work.* Super Chain is software that runs on infrastructure the family office controls: its private cloud or its own servers. Each answer is cited to the page it came from. Access is set by role, down to the single document, and each query is logged for the office. The office chooses the model, and keeps that provider’s terms in its own review. Read more on [what “private AI” means](https://www.super-chain.tech/private-ai-for-family-offices) and [how to protect family office data when using AI](https://www.super-chain.tech/protect-family-office-data-when-using-ai). who it is for ## Who this is for, *and who it isn’t.* This guide is for principals, COOs and compliance owners at single and multi-family offices whose staff already use ChatGPT, or are asking to. It is not for an office that has already banned hosted AI tools and enforces the ban. The cyber-safe AI roadmap will serve that office better. delivery ## How Super Chain is put in place, *and who does what.* - i **Scope.** The office names one owner and chooses one vehicle for the 30-Day Office Memory Pilot. The pilot runs on a dedicated, isolated deployment we host; together we agree where production will run: the office’s private cloud or its own servers. - ii **Deploy.** Our team installs Super Chain on that infrastructure and configures roles, document permissions and the model the office chooses. - iii **Load and check.** The office loads that vehicle’s documents, not a tidied sample. We review the first answers with the owner against the cited pages. - iv **Use.** For 30 days the team asks real questions. Every query is recorded in an audit log the office holds. Super Chain is accountable for the platform and its configuration. The office remains accountable for which documents go in, who may see them, and the terms of the model provider it chooses. // what can go wrong - A model or vendor changes its terms.** We check terms at selection and re-route to another model when they change. The office reviews them with its own compliance owner. - Some documents must stay in-house under the office’s policy.** We scope the deployment to that policy before any document moves. - Access and security review take longer.** We list what is needed at the start and raise blockers the day they appear. - No owner inside the office.** We pause until one person can decide. // track record Super Chain is built by Super Cat Technology. The same team built a [fully on-premise retrieval system for a Big 4 firm](https://www.super-cat.tech/portfolio/enterprise-rag-big-4), where every answer returns with its source paragraph. “When a family office asks me if ChatGPT is safe, I ask which account the side letter went into. The plan the office signed matters less than the personal login on someone’s phone. My advice is a written rule for hosted tools. Anything that names the family goes into a platform the office controls.” ## What Cat is seeing *in October 2026.* - October 2026 Principals ask me what their staff have already put into ChatGPT, not whether they may start. The question has moved from permission to clean-up. - October 2026 Offices want the written rule before the software: which documents stay out of a hosted assistant, and who answers for it. - October 2026 I point compliance owners to the FCA’s good-practice page of 19 October 2026, which describes matching AI architecture to the sensitivity of each use case. It gives a family office a test it can apply to every document type ([FCA, October 2026](https://www.fca.org.uk/publications/good-poor-practice/ai-financial-services)). read next ## Related *reading.* How to protect family office data when using AI → Five controls, in order, for any office using AI. A cyber-safe AI roadmap for family offices → Five decisions, who owns each, and where a platform fits. How the architecture is built → Deployment, access and audit, for the office’s IT team. questions ## The questions offices ask, *plainly answered.* ### Is ChatGPT safe for family office data? It depends on what the office puts in and what it has signed. As of October 2026, any hosted ChatGPT plan processes prompts and attachments on OpenAI’s servers; the plan sets the contract terms, not where the processing happens. Super Chain takes another route for family office data: it runs on infrastructure the office controls, private cloud or on-premise. ### Does ChatGPT train on family office data? That depends on the plan and its current terms. As of October 2026, OpenAI publishes different data terms for consumer and business plans, so the office should read the terms for the accounts its staff actually use. Super Chain does not train on client data, and it runs on infrastructure the family office controls. ### Can family office staff use ChatGPT for their work? For some of it. As of October 2026, Super Chain’s view is that hosted assistants suit drafting and research with no client data in the prompt. Statements, trust deeds, side letters and anything naming the family belong in a tool the office controls. Put the rule in writing, and name the person who answers questions about it. ### What is a safer alternative to ChatGPT for family office data? An AI platform that runs on infrastructure the office controls. As of October 2026, Super Chain is deployed on the family office’s own private cloud or servers. It answers from the office’s documents with the source page cited, limits each document to the roles cleared to see it, and records every query in an audit log the office holds. To see your own documents answered on your own infrastructure, Start the 30-Day Office Memory Pilot → // the next step ## The 30-Day Office Memory Pilot We load one vehicle’s documents onto a dedicated, isolated deployment hosted by Super Chain, with an enterprise model API. Your team asks real questions of them for 30 days, and each answer comes back cited to the page it came from. Production deployments run on-premise, on the office’s own infrastructure. Choose a time below to scope the pilot with us. If you would rather see the platform first, [book a private demonstration](https://calendly.com/super-chain/catyung?utm_source=super-chain.tech&utm_campaign=private-demonstration&utm_content=is-chatgpt-safe-for-family-office-data). [Open the scheduler →](https://calendly.com/super-chain/catyung?utm_source=super-chain.tech&utm_campaign=office-memory-pilot&utm_content=is-chatgpt-safe-for-family-office-data) --- # How to Protect Family Office Data When Using AI > Five controls, in order, for a family office using AI: custody, scope, access, audit and vendor terms, with who owns each and where a platform fits. Source: https://www.super-chain.tech/protect-family-office-data-when-using-ai Last modified: 2026-10-22 protecting family office data # How to protect family office data when using AI. Start with custody, then access. Decide which documents may reach an AI tool, run the tool on infrastructure the office controls, limit each document to the roles cleared to see it, and keep an audit log the office holds. A written rule for staff covers the tools nobody approved. custody · scope · access · audit · terms Written by [Cat Yung](https://www.super-cat.tech/cat-yung), Founder, Super Chain. Last updated 22 October 2026. where data leaks ## Where family office data *leaks into AI tools.* Most exposure comes from a document placed in a tool nobody approved. A statement goes into a free assistant, or a deed into a browser extension. Each hands the family’s affairs to an unreviewed service. In the 2026 RBC and Campden Wealth North America Family Office Report, published on 1 October 2026, 59 percent of 155 offices named cybersecurity and data breaches their top near-term operational concern. A year earlier it was 16 percent. (Source: [RBC Wealth Management, October 2026](https://www.rbcwealthmanagement.com/en-us/newsroom/2026-10-01/2026-rbc-and-campden-wealth-report-north-american-family-offices-shift-from-caution-to-optimism-amid-great-wealth-transfer-ai-acceleration).) five controls ## Five controls, *in order.* The order matters. Custody and scope decide most of the risk before any permission is set. - Custody.** Decide where the AI runs. A hosted tool processes data on the vendor’s servers. A platform on the office’s own private cloud or servers keeps that processing on infrastructure the office controls. - Scope.** List the documents that may never reach a hosted tool, by type: statements, deeds, side letters, anything naming the family. - Access.** Set permissions by role, down to the single document, so the analyst who reads one vehicle cannot query another. - Audit.** Keep a log of every question asked, held by the office, and read it on a schedule. - Terms.** Read the data terms of every AI vendor and model provider, date them, and read them again on renewal. who decides ## What the office decides, *and what a vendor can do.* The office decides which documents go in and who may see them. That decision sits with the principal or the COO, because it concerns the family’s information, with IT carrying out the work. A vendor can provide the deployment, the permission model and the log. The staff rule and the review stay with the office. For the questions staff ask most, read [is ChatGPT safe for family office data](https://www.super-chain.tech/is-chatgpt-safe-for-family-office-data). how super chain applies them ## How Super Chain applies *these controls.* Super Chain runs on the office’s own private cloud or servers, isolated from every other office. Access is set by role down to the single document, and each query is recorded in an audit log the office holds. Answers come from the office’s own documents, each cited to its page, and the office chooses the model the platform uses. The [trust and security page](https://www.super-chain.tech/trust) sets out the architecture. The [cyber-safe AI roadmap](https://www.super-chain.tech/cyber-safe-ai-roadmap-for-family-offices) sets out the order of decisions. who it is for ## Who this is for, *and who it isn’t.* This guide is for single and multi-family offices, and investment offices, whose staff use AI already or are about to, and whose documents carry family, tax and counterparty detail. It is not a full cyber programme. Email security, device management and penetration testing sit outside it, and an office needs those whether or not it uses AI. delivery ## How Super Chain is put in place, *and who does what.* - i **Scope.** The office names one owner and chooses one vehicle for the 30-Day Office Memory Pilot. The pilot runs on a dedicated, isolated deployment we host; together we agree where production will run: the office’s private cloud or its own servers. - ii **Deploy.** Our team installs Super Chain on that infrastructure and configures roles, document permissions and the model the office chooses. - iii **Load and check.** The office loads that vehicle’s documents, not a tidied sample. We review the first answers with the owner against the cited pages. - iv **Use.** For 30 days the team asks real questions. Every query is recorded in an audit log the office holds. Super Chain is accountable for the platform and its configuration. The office remains accountable for which documents go in, who may see them, and the terms of the model provider it chooses. // what can go wrong - Access and security review take longer.** We list what is needed at the start and raise blockers the day they appear. - Some documents must stay in-house under the office’s policy.** We scope the deployment to that policy before any document moves. - A model or vendor changes its terms.** We check terms at selection and re-route to another model when they change. - Daily use differs from the pilot.** We measure on the office’s real questions and report the numbers as they are. // track record Super Chain is built by Super Cat Technology. The same team built a [fully on-premise retrieval system for a Big 4 firm](https://www.super-cat.tech/portfolio/enterprise-rag-big-4), where every answer returns with its source paragraph. “Most of the protection is decided before any software arrives. Which documents go in, who may see each one, and who signs off the model provider’s terms? My team builds the platform so those decisions become settings the office can check. Access is set down to the single document, and the office holds the audit log.” ## What Cat is seeing *in October 2026.* - October 2026 Offices ask who can see the trust deed before they ask which model reads it. Document-level access comes up in the first conversation now, not the last. - October 2026 Banks drew a line this month. Charles Schwab’s chief executive said on 16 October 2026 that outside AI agents may check balances and research but not move client money ([TNW, October 2026](https://thenextweb.com/news/schwab-blocks-ai-agents-meta-muse)). When a family office asks me about its own agent, I start from the same place: what it may read, and what it may never do without a person. - October 2026 Offices want the provider’s terms filed with the contract and dated, because terms change and the office carries that review. read next ## Related *reading.* Is ChatGPT safe for family office data? → When a hosted assistant is reasonable, and when the data needs a different home. A cyber-safe AI roadmap for family offices → Five decisions, who owns each, and where a platform fits. What “private AI” actually means → The four tiers of AI privacy, and the trade-offs of each. questions ## The questions offices ask, *plainly answered.* ### How can a family office protect its data when using AI? Start with custody, then access. As of October 2026, Super Chain’s approach is to run the AI on infrastructure the family office controls, limit each document to the people and roles cleared to see it, and keep an audit log the office holds. Add a written rule on which AI tools staff may use, and review every vendor’s data terms. ### Should a family office block public AI tools? A blanket ban tends to push use onto personal phones, where the office cannot see it. As of October 2026, Super Chain’s view is that a written rule works better. Name the approved tools and list the documents that may never go into a hosted tool. Then give staff a sanctioned place for work that needs the family’s documents. ### What should a family office ask an AI vendor about its data? Four questions cover most of it. Where does the software run, and who operates that infrastructure? Which model provider does it call, and on what terms? Can access be set per document? Is there an audit log the office holds? As of October 2026, Super Chain suggests asking for each answer in writing, dated, and filing it with the contract. ### Does running AI on-premise make family office data safe? It moves custody to the office; it does not finish the job. As of October 2026, Super Chain’s view is that on-premise or private-cloud deployment needs document-level permissions and an audit log beside it. Without those, anyone with access to the system can ask about anything, and nobody can show who asked. To test these controls on one vehicle’s documents, Start the 30-Day Office Memory Pilot → // the next step ## The 30-Day Office Memory Pilot We load one vehicle’s documents onto a dedicated, isolated deployment hosted by Super Chain, with an enterprise model API. Your team asks real questions of them for 30 days, and each answer comes back cited to the page it came from. Production deployments run on-premise, on the office’s own infrastructure. Choose a time below to scope the pilot with us. If you would rather see the platform first, [book a private demonstration](https://calendly.com/super-chain/catyung?utm_source=super-chain.tech&utm_campaign=private-demonstration&utm_content=protect-family-office-data-when-using-ai). [Open the scheduler →](https://calendly.com/super-chain/catyung?utm_source=super-chain.tech&utm_campaign=office-memory-pilot&utm_content=protect-family-office-data-when-using-ai) --- # A Cyber-Safe AI Roadmap for Family Offices > Five decisions, taken in order, for a family office adopting AI safely: inventory, classify, place, permit, record. Who owns each, and where a platform fits. Source: https://www.super-chain.tech/cyber-safe-ai-roadmap-for-family-offices Last modified: 2026-10-22 cyber-safe ai roadmap # A cyber-safe AI roadmap for family offices. A cyber-safe AI roadmap is five decisions, taken in order. Find where staff already use AI, decide which documents may ever reach a model, choose where the platform runs, set access by role and document, and keep an audit log the office can read. Each decision belongs to the principal and the COO, with IT doing the work. inventory · classify · place · permit · record Written by [Cat Yung](https://www.super-cat.tech/cat-yung), Founder, Super Chain. Last updated 22 October 2026. where it starts ## Why the roadmap starts *with what staff already do.* AI usually reaches a family office before any policy does. A note-taking app joins the investment committee, a free assistant drafts a letter to the bank, a browser add-on reads every page it is shown. A roadmap that begins with platform selection skips that reality. The first stage is an honest list of what is already in use, made without blame, so the rest of the plan rests on facts. five stages ## Five stages, *and who runs each.* Each stage ends in a written decision, dated, that the next stage relies on. - Inventory, run by the COO with each team lead.** List every AI tool in use, including personal accounts, phone apps and browser add-ons. - Classify, decided by the principal and the COO.** Sort the office’s documents into those that may go into a hosted tool, those that may not, and those to decide case by case. - Place, run by the COO with IT.** Decide where the platform for sensitive work runs: a private cloud tenancy or the office’s own servers. Choose the model provider and write down the fallback. - Permit, run by IT and signed off by the COO.** Set access by role, down to the single document, and remove access the day someone leaves. - Record and review, owned by the compliance lead.** Keep an audit log the office holds, and review it with the vendor terms on a fixed schedule. what the regulator describes ## What the FCA describes *as good practice.* The FCA’s review of AI in financial services, published on 19 October 2026, describes firms adopting AI architecture that reflects the sensitivity of each use case, and keeping logs and audit trails of AI interactions. It names reliance on a single AI provider without exit options as an area for improvement. (Source: [FCA, October 2026](https://www.fca.org.uk/publications/good-poor-practice/ai-financial-services).) Most family offices are not FCA-regulated firms. The review is still a useful checklist, because it describes what careful financial firms already do. where a platform fits ## Where a platform fits *in the roadmap.* Super Chain covers stages three to five. It runs on the office’s own private cloud or servers, sets access by role down to the single document, and records each query in an audit log the office holds. Each office configures the model the platform uses, which supports the written fallback. The first two stages belong to the office. See also [how to protect family office data when using AI](https://www.super-chain.tech/protect-family-office-data-when-using-ai) and [on-premise AI for wealth management](https://www.super-chain.tech/on-premise-ai-for-wealth-management). who it is for ## Who this is for, *and who it isn’t.* This roadmap is for single and multi-family offices beginning to formalise how they use AI. It suits a principal or COO who wants a plan to sign, not a list of tools. It is not for an office with a mature security function. That office will fold these stages into its existing controls. delivery ## How Super Chain is put in place, *and who does what.* - i **Scope.** The office names one owner and chooses one vehicle for the 30-Day Office Memory Pilot. The pilot runs on a dedicated, isolated deployment we host; together we agree where production will run: the office’s private cloud or its own servers. - ii **Deploy.** Our team installs Super Chain on that infrastructure and configures roles, document permissions and the model the office chooses. - iii **Load and check.** The office loads that vehicle’s documents, not a tidied sample. We review the first answers with the owner against the cited pages. - iv **Use.** For 30 days the team asks real questions. Every query is recorded in an audit log the office holds. Super Chain is accountable for the platform and its configuration. The office remains accountable for which documents go in, who may see them, and the terms of the model provider it chooses. // what can go wrong - The process moves mid-way, for example a new custodian.** We re-scope against the new process and tell the office what that changes. - No owner inside the office.** We pause until one person can decide. - A model or vendor changes its terms.** We check terms at selection and re-route to another model when they change. - Some documents must stay in-house under the office’s policy.** We scope the deployment to that policy before any document moves. - The best answer turns out not to be AI.** We say so, and rank it alongside the AI options. // track record Super Chain is built by Super Cat Technology. The same team built a [fully on-premise retrieval system for a Big 4 firm](https://www.super-cat.tech/portfolio/enterprise-rag-big-4), where every answer returns with its source paragraph. “The roadmap I give a family office starts with what staff already paste into AI tools, not with a vendor shortlist. Then pick a platform you could switch to another model without starting again. On a private-markets search build, my team moved entity grouping to a model about 90% cheaper, and nothing else had to change.” ## What Cat is seeing *in October 2026.* - October 2026 When a family office asks me where to begin, it usually has no security team to hand the question to. The first useful step is the inventory, and it costs nothing but an afternoon of honest answers. - October 2026 The question I now suggest asking any AI vendor is how you would leave them. The FCA’s good-practice page of 19 October 2026 names reliance on one AI provider without an exit plan as an area for improvement ([FCA, October 2026](https://www.fca.org.uk/publications/good-poor-practice/ai-financial-services)). - October 2026 Probing a small firm with AI agents has become cheap. Reuters reported on 19 October 2026 that one operator used agents to break into more than 100 company websites ([Reuters, October 2026](https://www.staradvertiser.com/2026/10/19/breaking-news/how-one-hacker-used-ai-agents-to-break-into-over-100-company-websites/)). Offices with lean IT are asking me what that means for them. read next ## Related *reading.* How to protect family office data when using AI → Five controls, in order, for any office using AI. Is ChatGPT safe for family office data? → When a hosted assistant is reasonable, and when the data needs a different home. How the architecture is built → Deployment, access and audit, for the office’s IT team. questions ## The questions offices ask, *plainly answered.* ### What belongs in a cyber-safe AI roadmap for a family office? As of October 2026, Super Chain suggests five steps. List where staff already use AI, and decide which documents may ever reach a model. Choose where the platform runs, set access by role and document, and keep an audit log the office can read. Each step is a decision for the principal and the COO, not for IT alone. ### Who should own AI security in a family office? The principal or the COO, with IT doing the work. As of October 2026, Super Chain’s view is that the decisions in an AI roadmap concern the family’s information, so they sit with the person accountable for it. IT runs the deployment and permissions, and a compliance owner reviews the audit log and vendor terms. ### How does a family office avoid depending on one AI provider? Choose software that can run with more than one model, and write down the fallback. The FCA’s October 2026 good-practice review names single-platform dependence without exit options as an area for improvement. As of October 2026, Super Chain lets each office configure the model it uses, so the model can be changed per office. ### Where should a family office start with AI security? With an inventory of what staff already use. AI often arrives before any policy does: free assistants, note-taking apps, browser add-ons. As of October 2026, Super Chain suggests listing them, deciding which documents may ever reach them, and only then choosing a platform for the work that needs the family’s own documents. To run stages three to five on one vehicle first, Start the 30-Day Office Memory Pilot → // the next step ## The 30-Day Office Memory Pilot We load one vehicle’s documents onto a dedicated, isolated deployment hosted by Super Chain, with an enterprise model API. Your team asks real questions of them for 30 days, and each answer comes back cited to the page it came from. Production deployments run on-premise, on the office’s own infrastructure. Choose a time below to scope the pilot with us. If you would rather see the platform first, [book a private demonstration](https://calendly.com/super-chain/catyung?utm_source=super-chain.tech&utm_campaign=private-demonstration&utm_content=cyber-safe-ai-roadmap-for-family-offices). [Open the scheduler →](https://calendly.com/super-chain/catyung?utm_source=super-chain.tech&utm_campaign=office-memory-pilot&utm_content=cyber-safe-ai-roadmap-for-family-offices) --- # AI Tools for Mortgage Brokers and Lending Cases, Kept Private > The AI tools mortgage brokers use for lending cases — and the one that keeps the case file on your own infrastructure. Nothing leaves the room. Source: https://www.super-chain.tech/ai-for-mortgage-brokers Last modified: 2026-10-22 for the broker agency # AI tools for mortgage brokers and lending cases Most are built to chase the lead. Almost none are built for what happens after — *the case file full of SSNs, pay stubs, bank statements and tax returns* sitting on your side of the deal. Super Chain reads the case file, on the agency’s own infrastructure. six tool categories · sorted by whose data they touch · one that stays in the building Written by [Cat Yung](https://www.super-cat.tech/cat-yung), Founder, Super Chain. Last updated 22 October 2026. // the short answer Two groups: borrower-facing tools that convert leads, and case-file tools that read the broker’s own loan documents. Only the second touches regulated client data. the category, sorted ## Six kinds of tool, *sorted by whose data they touch.* Borrower chatbots, AI pre-underwriting, lender-side document processing, LOS and POS platforms, general-purpose assistants, and private case-file intelligence. Once the file is real, whose data each one touches is the only sort that matters. // 01 ### Borrower chatbots and lead-gen agents The tools most 2026 roundups lead with. They answer prospect questions around the clock, qualify and route. They touch enquiry data, not the case file. Voiceflow, OpenAssistantGPT, CustomGPT.ai // 02 ### AI pre-underwriting and document review These speed up document review and flag missing conditions. They touch the case file, and they are cloud services. Addy AI, Zeitro, Casca, FinLocker // 03 ### Lender-side intelligent document processing Built for the lender receiving the file, not the broker assembling it. Kolena, MightyBot, WisdomStream // 04 ### LOS and POS platforms Where the application lives once the borrower commits. ICE Encompass, Blend, Floify, nCino/SimpleNexus // 05 ### General-purpose assistants On nobody’s tool list, and the ones the trade press is warning brokers away from. This is the category’s real security exposure. ChatGPT, Claude, Gemini // 06 ### Private, on-premise case-file intelligence The one row here where the borrower’s documents never leave the brokerage’s own infrastructure. Super Chain the deciding factor ## Confidentiality is *the deciding factor.* A mortgage case file is not a CRM record. It is a stack of the most regulated personal data a private business ever handles: Social Security numbers, pay stubs, tax returns, bank statements, asset verifications. It is the same category of sensitivity as a family office’s [private client documents](https://www.super-chain.tech/private-ai-for-family-offices) — different vertical, identical exposure. "If you wouldn't want it public, don't put it into AI."And yet brokers are using AI anyway: in A&D Mortgage’s [2026 Broker Survey](https://admortgage.com/blog/ai-in-mortgage-industry/), 55% said they use AI daily or regularly and 72% expect their use to grow significantly within three years. the question, answered ## Can mortgage brokers put client data *into ChatGPT?* Not safely, and not quietly. Pasting a borrower’s file into a consumer assistant moves regulated personal data to a provider the brokerage has no contract with — and the obligation does not travel with it. - i **The liability stays with you.** Under the FTC Safeguards Rule a financial institution must select service providers capable of safeguarding customer information, require those safeguards by contract, and periodically reassess them ([16 C.F.R. § 314.4(f)](https://www.ftc.gov/business-guidance/resources/ftc-safeguards-rule-what-your-business-needs-know)). Put plainly: the broker stays responsible for how a provider handles borrower data. Outsourcing the tool does not outsource the liability. - ii **The trade press has said it already.** Mortgage Brain’s guidance to brokers was a one-line test: if you would not want it public, it does not go into AI. - iii **The alternative is not "no AI".** It is AI that runs where the case files already live, so there is no third party in the chain to be responsible for. // read next "Does it train on our data?" → The question every client-facing business asks, answered by architecture rather than policy. What "private AI" actually means → The four tiers of AI privacy — and why only the fourth is a wall rather than a promise. on-premise per-org isolation audit logging the tool the lead-gen lists don’t have ## Case-file intelligence *that stays in the building.* Not a chatbot for borrower intake: document intelligence for the agency’s own case files, running on the agency’s own infrastructure. // 01 ### Reads the file OCR and VLM document extraction over the documents already uploaded to the platform — classify, extract financials and dates, summarize. // 02 ### Pulls the figures out of the documents Income and asset figures come out of the pay stubs, statements and returns themselves rather than out of a re-keyed spreadsheet. // 03 ### Tracks conditions and key dates The obligation-and-date surface, pointed at loan conditions across live cases instead of fund covenants. // 04 ### Answers across every case file Plain-language questions over every file the agency holds, grounded in the agency’s own documents with citations back to the source page. // 05 ### Keeps files separated by access rule RBAC with fine-grained document and skill access control, and per-organisation isolation. // 06 ### Leaves an audit trail Audit logging and OpenTelemetry traces — the evidence a Safeguards Rule conversation needs. // 07 ### Runs on the agency’s own infrastructure Private cloud or on-premise. Nothing is sent to a third-party model provider. Private, on-premise AI intelligence for family offices, investment offices and broker agencies — nothing leaves the room. the category, side by side ## How does this compare *to the rest of the category?* Four questions, asked of every bucket above. The last column, Super Chain, is the only one where the answer to the second question is not somebody else’s data centre. | | Borrower chatbots | Cloud pre-underwriting | Consumer AI | Super Chain | | --- | --- | --- | --- | --- | | Touches the case file | No | Yes | Yes, unofficially | Yes | | Where the data goes | Vendor cloud | Vendor cloud | A public model provider | Stays on your infrastructure | | Who carries the liability | You | You | You | You — with nothing to hand over | | Built for | Conversion | Speed to close | Nothing in particular | Confidentiality | Every other tool on this list asks how much faster you can move. This one asks what happens to the file when you do. who it is for ## Who it suits, *and who it doesn’t.* Broker agencies that hold borrowers’ loan documents and want AI to read them without sending them to a third party. It is not for a broker who only wants to answer enquiries and convert leads: a borrower chatbot from the first category above serves that better, and touches no case file. the honest risks ## What are the risks of using AI *on lending cases?* The main risk is moving regulated borrower data to a provider the brokerage has not vetted or contracted, which the FTC Safeguards Rule leaves as the broker’s liability. Others are a figure read wrongly from a poor scan, and staff seeing files they should not. Citations to the source page and document-level access control address both; a person should still check figures before they go to a lender. See also [on-premise AI for wealth management](https://www.super-chain.tech/on-premise-ai-for-wealth-management). asked, plainly answered ## Asked by brokers, *plainly answered.* ### Can mortgage brokers put client data into ChatGPT or other consumer AI tools? Industry guidance says no. Mortgage Brain warned brokers plainly: "If you wouldn't want it public, don't put it into AI." And under the FTC Safeguards Rule a broker must select service providers capable of safeguarding customer information, require those safeguards by contract and reassess them — so the broker stays responsible for how a provider handles borrower data. ### What is the difference between AI for lead generation and AI for lending cases? Lead-gen AI touches enquiry data and is built to convert a prospect. Case-file AI reads the loan file itself, including income documents, bank statements and tax returns, which is regulated personal data. They are different risk categories, so a broker should evaluate them separately and ask where each one sends the data. ### Does Super Chain send loan documents to a third-party AI provider? No. Super Chain runs on the broker agency’s own infrastructure, on a private cloud or on-premise, with each organisation isolated from every other. Loan documents are not sent to a third-party model provider, and every request is recorded in an audit log the agency holds. Nothing leaves the room. ### What can Super Chain do with a lending case file? Super Chain extracts income and asset figures from uploaded documents, tracks loan conditions and key dates, and organises the case file. Staff can ask plain-language questions across every file the agency holds and get answers with citations back to the source document, so each figure can be checked against the page it came from. ### Is Super Chain a borrower chatbot? No. Super Chain has no borrower-facing surface. It is internal document intelligence for the brokerage’s own case files, used by the broker’s team rather than by applicants. Borrower chatbots and lead-gen agents are a separate category, built to answer prospect questions and convert enquiries, and they do not read the case file. ### Who in a brokerage can see a case file in Super Chain? Only the people the agency grants access to. Super Chain uses role-based access control down to individual documents and skills, so case files can be separated by team or adviser. Every view and question is recorded in audit logs and OpenTelemetry traces, which is the evidence a Safeguards Rule conversation needs. // the next step ## The 30-Day Office Memory Pilot We load one vehicle’s documents onto a dedicated, isolated deployment hosted by Super Chain, with an enterprise model API. Your team asks real questions of them for 30 days, and each answer comes back cited to the page it came from. Production deployments run on-premise, on the office’s own infrastructure. Choose a time below to scope the pilot with us. If you would rather see the platform first, [book a private demonstration](https://calendly.com/super-chain/catyung?utm_source=super-chain.tech&utm_campaign=private-demonstration&utm_content=ai-for-mortgage-brokers). [Open the scheduler →](https://calendly.com/super-chain/catyung?utm_source=super-chain.tech&utm_campaign=office-memory-pilot&utm_content=ai-for-mortgage-brokers) --- # Family Office AI That Doesn’t Train on Your Data — Super Chain > Super Chain does not train on your data because it runs inside your own infrastructure. Here is how that architecture keeps family office data in the room. Source: https://www.super-chain.tech/trust Last modified: 2026-10-23 trust, answered by architecture # *"Does it train* on our data?" Every cloud vendor answers this question with a policy: *we promise not to.* We answer it with architecture: the platform runs inside your walls, so there is no vendor-side model to train, no shared tenant to leak into, and no retention policy to read. *Nothing leaves the room.* no vendor-side model · no other tenants · no policy required Written by [Cat Yung](https://www.super-cat.tech/cat-yung), Founder, Super Chain. Last updated 23 October 2026. policy vs. architecture ## A promise you read, or *a wall you can inspect.* The concern is well founded — RSM, J.P. Morgan and Citi have each warned family offices about what AI tools may quietly learn from the data placed in them, and in July 2026 Squire Patton Boggs named confidentiality the sector’s defining AI constraint. [source: SPB White Paper, Jul 17 2026 →](https://www.familywealthreport.com/article.php/--Managing-Family-Offices%27-AI-Risk-%E2%80%93-SPB-White-Paper?id=208280) M22 and Plante Moran now publish the same warning as practical guidance for principals asking how to use AI safely with confidential data. [source: M22 →](https://www.m22.group/answers/family-office-ai-confidential-data) [source: Plante Moran, Mar 2026 →](https://www.plantemoran.com/explore-our-thinking/insight/2026/03/innovating-with-ai) iPaladin’s 2026 analysis goes further, naming the specific gap most family-office AI vendors leave unaddressed — where the data actually goes once a promise is made. [source: iPaladin →](https://www.ipaladin.com/architecture/what-every-family-office-ai-vendor-is-leaving-out) Most vendors respond with paperwork. We removed the surface the paperwork exists to cover. - i **No third-party transit.** On-premise deployment means client documents and conversations never reach a third-party model provider. There is nothing upstream to retain them. - ii **No other tenants.** There is no cross-tenant commingling because there are no other tenants. Your deployment serves one office: yours. - iii **The contrast, plainly.** A "zero-retention API" and a "private instance" are policies — your data still transits someone else’s infrastructure, and the protection is a clause you trust. Ours is a wall your own network team can verify. // the claim, in two sentences The platform runs inside your walls. There is nothing of ours for your data to train. — the one answer a policy can never match. no training on your data no telemetry no shared tenant own key vs. own infrastructure ## Your own key isn’t *your own infrastructure.* Bring-your-own-key (BYOK) is the newest version of the same evasion. It lets a client hold the encryption key — but the data still transits and is processed on the vendor’s shared cloud platform. Encrypting data before it leaves the building is not the same as never sending it. On-premise means there is no vendor infrastructure in the path: nothing to encrypt for transit, because nothing transits. the concrete surface ## What stays in the room — *all of it.* "Nothing leaves" is easy to say and easy to blur. Here is the inventory, item by item, of what lives and remains inside your infrastructure. ##### 01 · in the room documents every statement, deed and agreement — stored and read inside your network ##### 02 · in the room extractions the structured data the platform reads out of them ##### 03 · in the room chat history every question asked and every answer given ##### 04 · in the room embeddings the vector index built from your documents ##### 05 · in the room audit logs the record of who saw what, and when — yours to hold your network → your keys → your logs → your record asked, plainly answered ## The questions *every office asks.* ### Does Super Chain train on our data? No. Super Chain is deployed inside your own infrastructure, so your documents and conversations never reach a vendor-side model. There is no shared model to improve and no cross-tenant pool for your data to join — nothing leaves the room. The protection is architectural, not a clause in a policy. ### Where do our documents go? Nowhere. Documents, extractions, chat history, embeddings and audit logs are all stored and processed inside your network — on the office’s own servers or a private tenancy your IT team controls. Super Chain keeps no copy, receives no telemetry, and has no vendor-side store for them to reach. ### Can our IT team audit it? Yes. The platform runs where your team can watch it: your network, your keys, your logs. Every access and action is kept in an audit record that belongs to the office, and the absence of egress can be verified at your own firewall rather than taken on trust. ### What makes an AI architecture secure for a family office? An architecture is secure for a family office when data never leaves the office’s control: the model runs on-premise, there are no other tenants to be commingled with, no vendor-side store to be breached, and the audit trail belongs to the office. Security by design, not by policy or perimeter add-ons. Mapped to the four questions a family office’s own security advisors typically ask of any AI vendor — data classification, identity and access control, vendor selection, and audit posture — Super Chain’s answer to each is architectural: per-org isolation and RBAC (classification and access), no vendor in the loop once deployed on-premise (vendor selection), and OpenTelemetry traces plus audit logging (audit posture). ### Is bring-your-own-key (BYOK) encryption the same as on-premise? No. BYOK means the client controls the encryption key; the data still moves through and is processed on the vendor’s own cloud infrastructure. On-premise means the platform runs inside the family office’s own network — there is no vendor infrastructure the data ever has to reach. ### Where does the pilot run? The 30-Day Office Memory Pilot runs on a dedicated, isolated deployment hosted by Super Chain, with an enterprise model API. When the office goes into production, the platform moves to its own infrastructure with a self-hosted model. ### How can a family office protect its data when using AI? Start with custody, then access. As of October 2026, Super Chain’s approach is to run the AI on infrastructure the family office controls, limit each document to the people and roles cleared to see it, and keep an audit log the office holds. Add a written rule on which AI tools staff may use, and review every vendor’s data terms. ### What belongs in a cyber-safe AI roadmap for a family office? As of October 2026, Super Chain suggests five steps. List where staff already use AI, and decide which documents may ever reach a model. Choose where the platform runs, set access by role and document, and keep an audit log the office can read. Each step is a decision for the principal and the COO, not for IT alone. further reading — [the four tiers of "private AI" →](https://www.super-chain.tech/private-ai-for-family-offices)✦ [on-premise AI for wealth management →](https://www.super-chain.tech/on-premise-ai-for-wealth-management) · [case-file confidentiality for broker agencies →](https://www.super-chain.tech/ai-for-mortgage-brokers) · [how to protect family office data when using AI →](https://www.super-chain.tech/protect-family-office-data-when-using-ai) · [a cyber-safe AI roadmap for family offices →](https://www.super-chain.tech/cyber-safe-ai-roadmap-for-family-offices) // the next step ## The 30-Day Office Memory Pilot We load one vehicle’s documents onto a dedicated, isolated deployment hosted by Super Chain, with an enterprise model API. Your team asks real questions of them for 30 days, and each answer comes back cited to the page it came from. Production deployments run on-premise, on the office’s own infrastructure. Choose a time below to scope the pilot with us. If you would rather see the platform first, [book a private demonstration](https://calendly.com/super-chain/catyung?utm_source=super-chain.tech&utm_campaign=private-demonstration&utm_content=trust). [Open the scheduler →](https://calendly.com/super-chain/catyung?utm_source=super-chain.tech&utm_campaign=office-memory-pilot&utm_content=trust) --- # Privacy Policy — Super Chain > How Super Chain handles data on this website and inside the platform: no analytics cookies, tenant isolation, and no training on client data. Source: https://www.super-chain.tech/privacy-policy Last modified: 2026-07-27 [](https://www.super-chain.tech/)Legal # Privacy *Policy* // effective 7 July 2026 ## Who we are Super Chain ("we", "us") provides an enterprise AI platform for investment firms, family offices, and their advisors. The platform is deployed for each client organisation under a commercial agreement; it is not a consumer service and has no public sign-up. This policy covers two things: this marketing website (super-chain.tech), and our role in handling data processed inside the platform. For anything this policy does not answer, write to business@super-chain.tech. ## Data collected on this website This website is a brochure. It has no account creation, no forms, and sets no advertising or analytics cookies. - Server logs — our hosting infrastructure (Amazon Web Services CloudFront) records standard access logs: IP address, user agent, requested page, and timestamp. We use these only for security and operations, and they are retained for a limited period. - Demo bookings — if you book a demonstration, scheduling is handled by Calendly under its own privacy policy. We receive the name, email address, and meeting details you choose to provide, and use them solely to conduct and follow up on that conversation. ## Data processed inside the platform When a client organisation uses the platform, that organisation is the controller of the data it puts in — portfolio records, documents, conversations, and user accounts. We process this data only on the organisation’s instructions, under the terms of our agreement with them, and never use it to train models or for any purpose of our own. - Tenant isolation — each organisation’s data is segregated at the application and database layer; access is governed by roles the organisation controls. - Storage — structured data, documents, and vector indexes are held on Amazon Web Services infrastructure. Deployment region is agreed with each client. - AI processing — user queries and relevant document excerpts are sent to the large-language-model provider configured for the organisation, solely to generate the requested response. - Audit — the platform keeps an audit record of access and actions, which belongs to the client organisation. If you are an end user of the platform, your relationship is with the organisation that gave you access; direct any privacy request to them and we will support them in fulfilling it. ## Subprocessors We use a small number of service providers to run the service: Amazon Web Services (hosting, storage), the LLM provider configured for each deployment (AI inference), and Calendly (demo scheduling for this website only). Each is bound by contractual confidentiality and data-protection terms. ## Retention and deletion Platform data is retained for the duration of the client agreement and deleted or returned on termination, per that agreement. Website server logs are retained only as long as needed for security and operations. Demo-booking details are kept only as long as the business conversation is live. ## Security Data is encrypted in transit and at rest. Access to production systems is restricted, logged, and role-based. Client deployments carry short-lived, scoped credentials for internal service calls, and business data is never destructively deleted by application users — records are archived, not destroyed. ## Your rights Depending on where you are, you may have rights to access, correct, delete, or restrict the use of your personal data. For data collected through this website, contact us directly. For data inside a client deployment, contact the organisation that operates it — we act on their instructions. ## Changes and contact We may update this policy from time to time; the effective date above reflects the latest revision. Questions, requests, or concerns: business@super-chain.tech.