You choose where it runs.

• We do NOT use your data to train shared or public models
• Customer data is processed within isolated workspaces, not shared infrastructure
• All data in transit is encrypted (TLS 1.3); data at rest is encrypted (AES-256)
• Access is gated by SSO and short-lived tokens with audit logging
• Deletion on request — within 30 days, with deletion audit trail

• LLM calls through enterprise-grade API tiers (Anthropic, OpenAI, Google) with zero-retention agreements
• For sensitive workloads, we deploy on-premise or private cloud LLMs (Mistral, Llama)
• Model selection per workload — we don't lock you into any single vendor

• Background checks for all team members with customer data access
• MFA enforced on all internal systems
• Quarterly access reviews
• Incident response: 4-hour notification commitment for material incidents

Where your data lives is your call. We build to match. BuildClub deploys in three modes depending on what your security, compliance, and data residency posture requires. The deployment mode is decided in Phase 0, not after — and the choice shapes everything that follows: integration points, identity flow, audit logging, and where models actually run.

In-tenant. The full system runs inside your existing Azure, AWS, or GCP tenant. Your data never leaves your environment. Your identity provider stays the source of truth. Your existing audit logging captures every action. Best for HIPAA, financial services, regulated industries, and any organization with a formal data residency posture.

BuildClub-managed dedicated. A dedicated environment in BuildClub's AWS infrastructure, isolated per customer at the account level. Faster to deploy than in-tenant. Appropriate for companies with strong confidentiality requirements but no specific data residency mandate. Backed by signed DPAs, BAAs where applicable, and named-account SRE coverage.

Sovereign deployment. For organizations with explicit sovereign data residency requirements — regulated industries in specific jurisdictions, defense-adjacent work, certain public-sector deployments. Hosted entirely within the customer's specified national cloud region with no cross-border data flow.

When a user asks a question through BuildClub, the request is authenticated against the customer's IdP, evaluated against the user's partition scope, routed to the model layer with the appropriate retrieved context, and logged before the response returns. The model itself does not have unrestricted access to the customer's data — it sees only the partitioned, retrieval-grounded slice that the user's scope and the query intent justify.

The retrieval layer is what gives the system its operating discipline. We do not pass entire databases or document corpora to the model. We pass the minimum relevant context for the question being asked, drawn from partitions the user is authorized to access. This is what makes the same underlying knowledge base safely usable across teams with different access scopes.

Tool invocations — writing back to Salesforce, drafting a reply in Outlook, opening a case in ServiceNow — go through audited, scoped integrations. We do not give the model raw access to customer systems. Every tool call is an explicit, logged, permissioned operation, and the underlying integration uses service principals or OAuth scopes that the customer's IT team controls.

Architecture diagrams covering all of this in detail are in the Security & Architecture Brief, available under NDA.

Deployment mode is decided in Phase 0, alongside the data audit and operational mapping. By the end of Phase 0, you have an explicit recommendation on which deployment mode fits your security posture, your compliance requirements, and your operating model — and a clear-eyed view of what that decision implies for cost, timeline, and integration complexity downstream.

If you are evaluating BuildClub for an engagement and your security team needs answers before the first call, start with a Phase 0 conversation. We will give you the architecture briefing and the deployment-mode recommendation as part of that work.