Keeping client strategy data in your own environment

We built the sovereign mode before we met the objection, and then a real prospect articulated it better than we had. A governance and compliance partner at a consulting firm declined a hosted strategic tool on principle of architecture — not as a negotiating position, and not after reading a DPA. His reasoning: the firm's assets are immaterial. Client knowledge, methods, the shape of the questions they ask. That is trade-secret material, and its permanent residence at a vendor is a category of risk he does not accept for a management tool.

He framed it as a segment prerequisite, not a personal preference. Any practice living off confidentiality has the same reflex. Encryption at rest does not address it, because the objection is not about interception; it is about custody.

Residency is not a checkbox, it is a ladder — and a buyer should be told which rung they are standing on.

The floor, whatever the level: no use of your data to train models. That one is structural rather than promised — the language model in the loop is *yours*, reached through your own MCP client. We do not call a model on your behalf, so there is no inference path through which your strategy could be used for training.

• Level 1 — hosted: your organization on hoshin.app. EU hosting, strict per-organization isolation on every query, an audit trail on privileged operations. The classic SaaS relationship.
• Level 2 — hosted, published selectively: the same, plus revocable read-only links for people outside your organization. You choose what leaves and you can withdraw it.
• Level 3 — your own model: the assistant is yours. Your Claude, your Cursor, your API key. We never sit between you and a model provider.
• Level 4 — sovereign local: plain JSON files in a directory you chose, on your machine. No account, no network, no telemetry. The MIT-licensed code is auditable before you run it.

It is worth being precise, because "local" is used loosely in this market.

There is no HTTP client for your data in the local transport. Nothing is sent because there is nothing to send. There is no account to create, nothing phoning home, and no analytics. The files *are* the export — one JSON file per matrix, readable, diffable, and versionable in your own git repository, which also means an Article 20 portability request is satisfied by a copy command. Deletion is `rm`, not a support ticket and not a thirty-day retention window.

The engineering that matters if you are trusting it with the only copy: writes are atomic (temporary file, then rename), serialised through an in-process mutex so concurrent tool calls cannot interleave, and split one file per matrix so a bad write cannot take the whole dataset with it.

And the responsibility that comes with it: backups are yours. Local mode moves custody to you; it does not remove the duty of care.

Publishing a public share link is refused in local mode, and the tool returns an error saying so. This is not an unimplemented feature. Publishing needs a server to publish to, and quietly standing one up would undo the guarantee the mode exists to provide.

The substitute is better suited to the segment anyway. Ask your agent for a matrix artifact: it renders a self-contained interactive snapshot of the strategy that you send deliberately, once, to a recipient you chose — rather than a URL that keeps serving your client's strategy until someone remembers to revoke it. For a firm, a one-shot artifact is easier to defend to a client than a live link.

A sovereign mode that lags behind the hosted one is a marketing claim, not a feature. So the scoring engine is pure — elements and correlations in, a verdict out — and a test compares the hosted implementation against the local one on the same matrix, asserting an identical score, an identical level and an identical list of suggestions. If the cloud version ever gains a rule the local one lacks, the build fails.

The same rule governs the tool contract: 14 tools, one shared definition, and a test that every transport implements every one of them. Your client's strategy is judged the same way whether it sits in our database or on your laptop — which is the only way a firm can defend using the sovereign mode without telling clients they got the lesser product.

We are a small product and we would rather you learn our limits here than in a security review. We do not hold SOC 2 Type II or ISO 27001. We do not publish a signed DPA template on this page today — ask us and we will discuss the specifics of your engagement. Our sub-processors are limited: hosting and transactional email. Nothing else touches your content.

If your client requires certifications from every vendor in the chain, a larger platform will clear that bar and we will not. If your client requires that no vendor holds the data at all, we are one of the only options that can say yes.