Every cloud vendor answers this question with a policy: we promise not to. We answer it with architecture: the platform runs inside your walls, so there is no vendor-side model to train, no shared tenant to leak into, and no retention policy to read. Nothing leaves the room.
The concern is well founded — RSM, J.P. Morgan and Citi have each warned family offices about what AI tools may quietly learn from the data placed in them, and in July 2026 Squire Patton Boggs named confidentiality the sector’s defining AI constraint. source: SPB White Paper, Jul 17 2026 → M22 and Plante Moran now publish the same warning as practical guidance for principals asking how to use AI safely with confidential data. source: M22 → source: Plante Moran, Mar 2026 → iPaladin’s 2026 analysis goes further, naming the specific gap most family-office AI vendors leave unaddressed — where the data actually goes once a promise is made. source: iPaladin → Most vendors respond with paperwork. We removed the surface the paperwork exists to cover.
Bring-your-own-key (BYOK) is the newest version of the same evasion. It lets a client hold the encryption key — but the data still transits and is processed on the vendor’s shared cloud platform. Encrypting data before it leaves the building is not the same as never sending it. On-premise means there is no vendor infrastructure in the path: nothing to encrypt for transit, because nothing transits.
"Nothing leaves" is easy to say and easy to blur. Here is the inventory, item by item, of what lives and remains inside your infrastructure.
No. Super Chain is deployed inside your own infrastructure, so your documents and conversations never reach a vendor-side model. There is no shared model to improve and no cross-tenant pool for your data to join — nothing leaves the room. The protection is architectural, not a clause in a policy.
Nowhere. Documents, extractions, chat history, embeddings and audit logs are all stored and processed inside your network — on the office’s own servers or a private tenancy your IT team controls. Super Chain keeps no copy, receives no telemetry, and has no vendor-side store for them to reach.
Yes. The platform runs where your team can watch it: your network, your keys, your logs. Every access and action is kept in an audit record that belongs to the office, and the absence of egress can be verified at your own firewall rather than taken on trust.
An architecture is secure for a family office when data never leaves the office’s control: the model runs on-premise, there are no other tenants to be commingled with, no vendor-side store to be breached, and the audit trail belongs to the office. Security by design, not by policy or perimeter add-ons. Mapped to the four questions a family office’s own security advisors typically ask of any AI vendor — data classification, identity and access control, vendor selection, and audit posture — Super Chain’s answer to each is architectural: per-org isolation and RBAC (classification and access), no vendor in the loop once deployed on-premise (vendor selection), and OpenTelemetry traces plus audit logging (audit posture).
No. BYOK means the client controls the encryption key; the data still moves through and is processed on the vendor’s own cloud infrastructure. On-premise means the platform runs inside the family office’s own network — there is no vendor infrastructure the data ever has to reach.
The 30-Day Office Memory Pilot runs on a dedicated, isolated deployment hosted by Super Chain, with an enterprise model API. When the office goes into production, the platform moves to its own infrastructure with a self-hosted model.
Start with custody, then access. As of October 2026, Super Chain’s approach is to run the AI on infrastructure the family office controls, limit each document to the people and roles cleared to see it, and keep an audit log the office holds. Add a written rule on which AI tools staff may use, and review every vendor’s data terms.
As of October 2026, Super Chain suggests five steps. List where staff already use AI, and decide which documents may ever reach a model. Choose where the platform runs, set access by role and document, and keep an audit log the office can read. Each step is a decision for the principal and the COO, not for IT alone.
We load one vehicle’s documents onto a dedicated, isolated deployment hosted by Super Chain, with an enterprise model API. Your team asks real questions of them for 30 days, and each answer comes back cited to the page it came from. Production deployments run on-premise, on the office’s own infrastructure.
Choose a time below to scope the pilot with us. If you would rather see the platform first, book a private demonstration.