Security
Private by default, across the whole stack
PrivateMind was built for financial firms that cannot send sensitive data to a public AI service. Your prompts and outputs are never used for training, open-weight work never leaves our network, and your firm stays in control. This page sets out how.
PrivateMind network
Your dataOpen-weight modelsNVIDIA GPUsEncrypted storage
Isolated per client, encrypted, never trained on
Only if enabled
Frontier providers
Claude, OpenAI, Amazon Bedrock
Data
Your data is kept separate and held in the country you choose.
- Never used for training
- Prompts, files and outputs your firm sends to PrivateMind are never used to train models. Fine-tunes you choose to run write their weights to your own storage.
- Separate databases by client
- Each client’s data is kept in its own database, which goes further than logical separation inside a shared one.
- Data sovereignty
- Choose where workloads and data live, to help meet UK and EU GDPR and outsourcing requirements on where data is held.
- Open-weight by default
- Open-weight models run on PrivateMind-controlled hardware, so those requests never reach a public cloud. Hybrid routing to frontier providers is off by default. When an administrator turns it on, only requests sent to a frontier model leave our network, and they are recorded like any other request.
- Memory is opt-in
- Memory is off by default and needs both your organisation and the individual to turn it on. It is private to that person and can be deleted at any time.
- Confidential computing
- For the most sensitive workloads, confidential computing keeps data protected while it is being processed, not only when it is stored or moving.
Encryption and keys
Encryption everywhere, with your own keys on enterprise contracts.
- Encrypted in transit
- Traffic to and within the platform is encrypted, from your applications and users to the models and storage behind them.
- Encrypted at rest
- Data is encrypted at rest with AES-256-GCM, including datasets, checkpoints and model weights.
- Bring your own key
- On enterprise contracts, use encryption keys your firm creates and manages, so access to your data depends on keys you control and can revoke.
- You are in control
- You decide which models, connectors and features are switched on, who can use them, where data lives and whether frontier routing is allowed at all.
Private connectivity
Your data is processed inside our network. Pooled capacity is reached over the internet with encryption, and dedicated circuits are available when you need them.
- Never leaves the network
- Open-weight inference, training and storage all run inside the PrivateMind network, so your data is not handed to a public cloud along the way.
- Dedicated circuits
- Connect your offices and data centres over dedicated WAN circuits, with live visibility of every circuit through AtlasVision on the Options Technology network.
Network and hosts
Every client starts out isolated.
- Isolated by default
- Networks and resources are isolated for every client before anything is deployed on them.
- Security groups and firewalls
- Internet access passes through security groups and firewalls, with your own route tables and CIDR blocks.
- Managed host security
- EDR across hosts and containers, with logs integrated into your SIEM if you want them there.
- Your own addressing
- Public IPs are available when you need them, alongside your own route tables and CIDR blocks.
Identity and access
People sign in the way your IT team already manages.
- Single sign-on and MFA
- Connect your identity provider on enterprise contracts. Multi-factor authentication is required for everyone who uses the chat app.
- Secrets in vaults
- Credentials used by workloads are kept in managed vaults rather than in code or configuration files.
- Teams and roles
- Organise people into teams with the roles they need, including a compute administrator for GPU capacity.
- Permissions carried through
- Connectors such as Microsoft 365 use each person’s own sign-in, so the assistant only sees what that person could already see.
Oversight and operations
You can see what is happening, and so can we, around the clock.
- Audit logging and compliance API
- On enterprise contracts, administrative and collaboration actions are logged per organisation and can be exported through the compliance API.
- Budgets and rate limits
- Spend caps and request limits apply per API key, per user and per organisation, enforced on the server.
- Service levels
- SLAs are available on enterprise contracts for firms that need agreed service levels in writing.
- 24/7 operations
- A NOC and round-the-clock alerting, with live service status published at status.privatemind.com.
Speak to a PrivateMind engineer today
Our engineers can walk your security and compliance teams through the platform, part by part.