No training
Nothing in a Keep is used to train any model. Client financial data should never be an AI vendor's training set.
Home / Zero-data-retention AI
DefinitionWhat is zero-data-retention AI for fiduciaries?
Model providers do not keep client data for training; the firm controls retention and deletion; nothing is shared across trusts; only a fingerprint leaves the firm boundary.
Definition
Zero-data-retention AI for fiduciaries means three things at once: model providers do not keep client data for training; the firm controls retention and deletion; nothing is shared across trusts. Only a fingerprint leaves the firm boundary. It does not mean r.Team keeps no fiduciary records.
The firm sets retention
The trust company sets retention and deletion. Closing a trust, or a family deleting a document, removes it everywhere in one action.
The Record
A tamper-evident record the firm is obliged to keep. The proposal and the human decision stay distinct.
Why it matters
Families are already asking public AI assistants about statements, the trust, and their own documents. For a trust company, that is a boundary problem: account numbers, positions, beneficiary names, and the governing instrument leave under consumer terms the firm never reviewed and cannot enforce.
Public AI assistants
Data leaves the boundary under consumer terms the trust company never reviewed. There is no firm record of what was asked or answered. The trustee is cut out.
The fiduciary boundary
Keep runs inside a data boundary the trust company controls. Nothing a family places in a Keep is used to train any model, shared with any other trust, or readable by anyone the family has not authorized. The trust company's own agreements govern the data.
What it means in practice
These are the controls already published on Keep and the Platform. Architecture, isolation, and subprocessors are reviewed in diligence under NDA. We do not publish a certification badge set on this site.
No training, no sharing
Nothing in a Keep is used to train any model. The trust company's own agreements govern the data, not a consumer assistant's terms of service.
One boundary per trust
Each Family Trust Account has its own sealed space. Separation is enforced at the data layer, not by a rule the model is asked to follow.
Firm-controlled retention
The trust company sets retention. Closing a trust, or a family deleting a document, removes it everywhere in one action.
Last-four identifiers
Account numbers are held as last-four only. Identifiers the model does not need are never stored.
Fingerprint-only public record
Client data stays inside the firm boundary. The public record carries a fingerprint, not a file. Only a 32-byte fingerprint is published.
Exit
If you leave, your data leaves with you. Keep attaches to what you run today. It does not replace trust accounting, custody, or the portfolio system.
What the firm still keeps on purpose
Zero-data-retention here is about model providers and training pipelines — not about erasing the fiduciary file. Keep writes every exchange to the trust's own record. The Record is a tamper-evident record — a hash-chained log — so an examiner can check later. That is the record the firm is obliged to keep.
Keep exchanges
Every question, the sources used, and the answer are written to the trust's own record, alongside the officer's decisions. The proposal and the decision are distinct, and both are kept.
The Record
Every fiduciary event is written to a per-account hash chain. The human decision is part of the record. The engine's proposal is part of the record. They are distinct.
Inference, logged
Model calls are recorded with the agent, the account scope, the policy version, and the prompt context hash. Inference traffic becomes an auditable ledger, not a black box.
What this page is
- No training on client data by model providers.
- Firm-controlled retention and deletion of trust data.
- One boundary per trust, enforced at the data layer.
- A fingerprint — never a client file — on the public record.
- An intentional fiduciary record the firm is obliged to keep.
What this page is not
- It does not mean r.Team keeps no records.
- It is not the website Privacy Policy — that page is about marketing-site forms.
- It does not publish a certification badge set on this site.
- It does not decide. The named officer decides.
- It does not replace counsel, a trust officer, or a committee.
How it fits r.Team
The same boundary runs through Keep, the Platform, and the Record. The copilot still prepares, cites, and stops. The named officer decides.
Keep
Keep runs inside a data boundary the trust company controls. One Keep per Family Trust Account. Explains and cites. Never advises. Private by design: instruments stay inside the firm boundary.
Keep →Platform data boundary
Client data stays inside the firm boundary. No client names, account numbers, positions, instruments, or rationales leave it. Architecture, isolation, and subprocessors are reviewed in diligence under NDA.
Platform →The Record
A tamper-evident record. Hash-chained events. A fingerprint — never a client file. Change an earlier entry and the break is visible.
The Record on the Platform →Infrastructure
Client financial data should never be an AI vendor's training set. Model choice and governance without committing data to any single AI lab. Documents held close, zero egress, on the same platform.
Why Cloudflare →
01
Reasoning Engine
Prepares, explains, and proposes beside the team. It does not decide.
02
The Bridge
One governed doorway to the systems you already run. Read first. Write only after human approval.
03
The Record
A tamper-evident record. Hash-chained events. A fingerprint — never a client file.
A fiduciary copilot still reads, prepares, and cites. Nothing happens until a person approves. See Keep, the Platform, and Why Cloudflare for the stack.
Related: Keep · Platform · What is a fiduciary copilot? · AI for bank trust departments and trust companies · What is a Trust Administrator Pod? · Why Cloudflare · Privacy Policy · Vocabulary
Questions teams ask first
Short answers from the published site. Open a question to read it.
Does zero-data-retention mean r.Team keeps no fiduciary records?
No. Keep writes every exchange to the trust's own record. The Record is a tamper-evident record — a hash-chained log of every decision — that an examiner can check later. The proposal and the human decision are distinct, and both are kept. That record is what the firm is obliged to maintain.
Is client data used to train any model?
Nothing a family places in a Keep is used to train any model, shared with any other trust, or readable by anyone the family has not authorized. The trust company's own agreements govern the data, not a consumer assistant's terms of service. Client financial data should never be an AI vendor's training set.
What leaves the firm boundary?
Client data stays inside the firm boundary. The public record carries a fingerprint, not a file. No client names, account numbers, positions, instruments, or rationales leave the firm boundary. Only a 32-byte fingerprint is published.
Who sets retention and deletion?
The trust company sets retention. Closing a trust, or a family deleting a document, removes it everywhere in one action. Account numbers are held as last-four only; identifiers the model does not need are never stored. If you leave, your data leaves with you.
How is one trust kept separate from another?
One boundary per trust. Each Family Trust Account has its own sealed space. The separation is enforced at the data layer, not by a rule the model is asked to follow. Instruments, accounts, and rationales stay inside the firm's boundary. Nothing about one client's trust informs another firm's work.
Is this the same as the website Privacy Policy?
No. The website Privacy Policy explains how Got-Data Inc. collects, uses, and protects information when you visit r.team or submit forms. This page is the product posture: model providers do not keep client data for training; the firm controls retention and deletion; the Record is kept on purpose.
Request a demo
A focused demo of the Reasoning Engine, the Bridge, and the Record — or start a conversation.
A named officer decides, and every decision is recorded.