It runs where your data already sits
Your cloud, a dedicated arrangement, or your own premises, chosen against the obligation that applies.
Nothing regulated leaves
Service
AI deployed inside your own environment, because your data cannot leave it
For firms where client data is the constraint, we build systems that run where your data already sits, with access controls and a record of every action, so compliance is a property of the build rather than a promise about it.
Free · You keep the write-up either way
85%average time saved on manual work
100%audit and visibility on every action
Typical focus areas
Data extraction·Lead routing·Status tracking·Report generation·Data reconciliationor anywhere your team spends hours doing repetitive data work.
In short
Compliant AI deployment means running the system inside infrastructure the organisation controls, so regulated data never passes to a third party. In practice that involves choosing a hosting arrangement that satisfies the relevant obligation, restricting access to named people, keeping a record of every action for audit, and being able to demonstrate all of it. For sectors under HIPAA, financial regulation or legal privilege, this is usually what decides whether an AI project can proceed at all.
Works with the systems you already run
AWS
Google Cloud
Anthropic
SharePoint
iManageThe problem
The blocker is almost never the technology
A partner sees what these systems can do and immediately asks the only question that matters in a regulated firm: where does the file go. If the honest answer is a third party in another country, the conversation is over, and it should be.
So the deployment decision comes first and the capability second. Once the system runs inside infrastructure you control, with access restricted to people you have named and a record of everything it did, the project becomes an ordinary one.
- 01
The obvious tools send your files to someone else's infrastructure
For privileged, health or client-money data that is not a risk to be managed, it is a rule to be followed. It rules out most of what the market is selling before any evaluation begins.
- 02
You cannot show an auditor what the system did
Who asked what, which records were touched, what came back. Without that record the system cannot be signed off, however well it performs.
- 03
A tool bought on a card by one department
It works, so it spreads. Six months later client data is in a system procurement has never reviewed and nobody can say who has access.
- 04
The agreement in place does not permit this use
The vendor terms allow them to retain and process the data in ways your own client agreements do not. It is discovered late, usually by someone reading the terms properly for the first time.
What changes
The same week, run differently
How it runs nowHow it runs after
Client files would have to go to a third party.
They stay inside infrastructure you control.
There is no record of what the system did.
Every action is logged, attributable and exportable.
Access spreads informally through a department.
Only named people can reach it, and that list is reviewed.
Compliance is a promise in a sales deck.
Compliance is a property of where and how it runs.
What we build
What deploying it properly involves
Only named people can reach it
Access is a list you control and review, not something that spreads informally through a department.
Procurement can sign it off
Every action is on the record
Who asked, what was touched, what came back. Exportable, because somebody will eventually ask.
An audit takes minutes
Documented for whoever asks
Written up for a client, an auditor or an insurer, so the answer does not need assembling under pressure.
No scramble at review time
Proof
What this has actually done
Every engagement we take in legal, health or financial work starts with this question rather than ending with it. The deployment shape gets settled before anyone discusses what the system will do, because it determines what is possible. Firms that take it in the other order tend to build something they then cannot use.
How it works
From first call to running system
- 01
We start with the obligation, not the tool
Which regulation, which client commitments, which data. That determines what is permitted, and everything else follows from it.
- 02
We choose the deployment that satisfies it
Your own cloud, a dedicated arrangement, or fully on your premises. Each has different cost and effort, and the obligation decides which is actually available to you.
- 03
We build the controls in from the start
Access limited to named people, a record of every action, retention rules that match your policy. Added afterwards these never quite fit.
- 04
We document it for the people who will ask
Written up so it can be handed to a client, an auditor or an insurer without a scramble. That document is part of the deliverable.
How we compare
Agency vs in-house vs freelancer vs DIY
| Chronexa | In-house hire | Freelancer | DIY tool | |
|---|---|---|---|---|
| System ownership | You own it | You own it | You own it | Rented (SaaS) |
| Time to production | 4–6 weeks | 3–6 months | Varies | Months of trial & error |
| Cost model | Fixed price | $120k+ salary | Hourly rate | Subscription + time |
| Maintenance included | ||||
| Security & compliance | Varies | Varies | ||
| Guaranteed outcome |
* In-house costs assume a full-time mid-level engineer. Time-to-production estimates are averages based on our client data.
Confidence & control
What happens when the system is unsure
- The data does not leave
- Where the obligation requires it, everything runs inside infrastructure you control and no regulated material passes to a third party. That is a property of the deployment rather than an assurance in a contract.
- Everything is attributable
- Who asked, what was touched, what came back and when. Exportable, because at some point somebody will ask for it and the answer needs to take minutes rather than weeks.
- We tell you where the limits are
- Some obligations rule out approaches that would otherwise be cheaper and better. We would rather set that out plainly at the start than let it surface during a client audit.
- You own it when we leave
- It is built inside your own accounts and your own cloud. If you never speak to us again it keeps running, and another team could pick it up. You are not renting your own process back from us.
Scope
What an engagement covers
Included
- A review of the obligations that apply to the data in question
- A deployment recommendation with the cost and effort of each option
- The build itself, inside infrastructure you control
- Access restricted to named people, with a record of every action
- Retention and deletion rules matching your policy
- Written documentation for clients, auditors and insurers
Not included
- Legal advice on your obligations. We build to the requirements you and your advisers set.
- Certification or accreditation. We build to the standard and document it; the assessment is separate.
- Ongoing infrastructure costs, which sit with your cloud or hosting provider directly.
- A claim that any deployment makes you compliant. Compliance is about your whole process, not one system.
Scope, timeline and price are agreed after a short call, never before. We write down what the system has to do, and what it costs, before any build starts.
Questions
Frequently asked
Does on-premise mean we need our own servers?
Not usually. For most firms the practical answer is a private arrangement inside your own cloud account, which satisfies the obligation without you running hardware. Genuine on-premise is available where the requirement demands it, and it costs more.
Can you sign a business associate agreement?
Where the engagement involves health data and we are handling it, that is a normal part of the arrangement. It is worth raising on the first call because it shapes how the deployment is designed.
Is a private deployment much more expensive?
It costs more than the public option and usually less than people expect, and the comparison that matters is against not being able to do the project at all. We set out the options with their costs so the choice is yours to make.
How do we prove this to a client or an auditor?
With the documentation, which is part of what we deliver: where it runs, who can reach it, what is recorded and how long things are kept. Producing that at the point of the question is the thing that goes badly for most firms.
Does this slow the system down?
Marginally, in some configurations. In the work we do the difference is not noticeable next to the process it replaces, and it is the price of the data staying where it has to stay.
What does it cost?
Every engagement is priced to its own scope, so there is no list price. After a short discovery call we agree in writing what the work covers and what it costs, before any build starts.
Still deciding? Book a discovery call and we will tell you honestly whether this is worth building for you.
Related
Other things we build
Bring us the workflow that keeps eating your team's week.
Let's find the first one to fix.
The audit is free. If we can't find automation worth more than it costs to build, you owe us nothing, and you keep the roadmap.
Prefer email? info@chronexa.io
Or tell us what's slow
We'll review your workflows and come back with where AI saves the most time and cost.