Data sovereignty
Firmcraft's default position is that client data remains within the client's own environment. This page sets out what that means in practice and how the decisions are made.
The default position
Where an artificial intelligence capability can reasonably be operated inside a client's own infrastructure, that is how Firmcraft builds it. Client records, documents, and operational data remain within the client's control, and the organization retains the ability to audit what has been processed and when.
When hosted services are appropriate
There are tasks for which a hosted model is the better tool, and Firmcraft will recommend one where that is the case. Where it does, three conditions apply. The decision is made explicitly and recorded, rather than arrived at because it was the simpler path to build. The data handling terms are reviewed and found acceptable by the client. And the categories of data involved are agreed in advance rather than determined during implementation.
What clients own
Firmcraft deploys an open-source foundation, licensed under Apache 2.0, when a self-hosted and client-owned configuration is the appropriate answer. Where that applies, the client owns the deployment. Firmcraft maintains it under the managed services relationship, but the client is not dependent on that relationship continuing in order to keep operating. This is not offered as a required component of every engagement. Where a client's circumstances call for a different configuration, that is what Firmcraft builds.
Commitments in writing
Sovereignty commitments belong in the engagement agreement rather than on a marketing page. Firmcraft will put its data handling undertakings into the contract, and expects to be asked to.