Every cloud vendor answers this question with a policy: we promise not to. We answer it with architecture: the platform runs inside your walls, so there is no vendor-side model to train, no shared tenant to leak into, and no retention policy to read. Nothing leaves the room.
The concern is well founded — RSM, J.P. Morgan and Citi have each warned family offices about what AI tools may quietly learn from the data placed in them, and in July 2026 Squire Patton Boggs named confidentiality the sector’s defining AI constraint. source: SPB White Paper, Jul 17 2026 → M22 and Plante Moran now publish the same warning as practical guidance for principals asking how to use AI safely with confidential data. source: M22 → source: Plante Moran, Mar 2026 → iPaladin’s 2026 analysis goes further, naming the specific gap most family-office AI vendors leave unaddressed — where the data actually goes once a promise is made. source: iPaladin → Most vendors respond with paperwork. We removed the surface the paperwork exists to cover.
Bring-your-own-key (BYOK) is the newest version of the same evasion. It lets a client hold the encryption key — but the data still transits and is processed on the vendor’s shared cloud platform. Encrypting data before it leaves the building is not the same as never sending it. On-premise means there is no vendor infrastructure in the path: nothing to encrypt for transit, because nothing transits.
"Nothing leaves" is easy to say and easy to blur. Here is the inventory, item by item, of what lives and remains inside your infrastructure.
No. Super Chain is deployed inside your own infrastructure, so your documents and conversations never reach a vendor-side model. There is no shared model to improve and no cross-tenant pool for your data to join — nothing leaves the room. The protection is architectural, not a clause in a policy.
Nowhere. Documents, extractions, chat history, embeddings and audit logs are all stored and processed inside your network — on the office’s own servers or a private tenancy your IT team controls. Super Chain keeps no copy, receives no telemetry, and has no vendor-side store for them to reach.
Yes. The platform runs where your team can watch it: your network, your keys, your logs. Every access and action is kept in an audit record that belongs to the office, and the absence of egress can be verified at your own firewall rather than taken on trust.
An architecture is secure for a family office when data never leaves the office’s control: the model runs on-premise, there are no other tenants to be commingled with, no vendor-side store to be breached, and the audit trail belongs to the office. Security by design, not by policy or perimeter add-ons. Mapped to the four questions a family office’s own security advisors typically ask of any AI vendor — data classification, identity and access control, vendor selection, and audit posture — Super Chain’s answer to each is architectural: per-org isolation and RBAC (classification and access), no vendor in the loop once deployed on-premise (vendor selection), and OpenTelemetry traces plus audit logging (audit posture).
No. BYOK means the client controls the encryption key; the data still moves through and is processed on the vendor’s own cloud infrastructure. On-premise means the platform runs inside the family office’s own network — there is no vendor infrastructure the data ever has to reach.
A first conversation, in person where we can. We listen to how the house works before we ever speak about the platform.