Where your data lives
In your cloud, not ours. We build on Amazon Web Services inside an account that your firm owns and pays for. Your documents, models, emails and data vendor feeds stay in that account, in the region you choose. Mosaic Macro holds no copy of your data on our own infrastructure once an engagement is delivered.
- Your AWS account, your billing. You see every resource and every dollar.
- Encrypted at rest and in transit using AWS-managed keys, or your own keys if your policy requires it.
- No shared tenancy. Nothing we build for one client is hosted alongside another's.
Which models, on what terms
The language models behind our tools come from three providers, and only on their enterprise or API tiers, never consumer accounts.
- Amazon Bedrock, which runs models inside your own AWS account. Prompts and outputs never leave AWS and are not shared with the model provider. This is our default where the policy is strict.
- Anthropic (Claude) and OpenAI via their commercial APIs, which carry zero-data-retention terms and do not train on customer inputs.
- Nothing is trained on your data, by us or by any provider we use. Where a tool needs to "know" your documents, it reads them at question time from your own storage rather than being trained on them.
We put the provider, the tier, the data-retention terms and the data flow in a one-page diagram for every tool we deliver. It is written so your CCO can read it in five minutes and attach it to the vendor file.
MNPI and insider treatment
We work inside investment teams, so we assume we will be exposed to material non-public information and act accordingly.
- NDA and your insider policy before any access. We sign your NDA and agree to be treated under your firm's personal-trading and restricted-list rules for the duration of the engagement.
- Read-only by default. Tools that read broker research, emails or internal memos do not send that content anywhere outside your account.
- No cross-client leakage. Nothing learned at one firm informs a build at another. We do not maintain a shared corpus of client material.
- Expert-network and MNPI-flagging rules in your compliance manual can be built into the tools themselves, so an email digest, for example, can flag content that needs a compliance review.
Access and credentials
- Least privilege. We ask for the narrowest access that lets us do the work, scoped to the specific folders, mailboxes and systems in the engagement.
- Named accounts and MFA. Every person from Mosaic Macro who touches your systems has a named account you control, with multi-factor authentication. No shared logins.
- Logged. AWS CloudTrail and your own identity provider record what we did and when.
- Revoked at exit. When an engagement ends, you switch our access off. Nothing we built depends on our credentials staying alive.
Retention and deletion
- During an engagement, working files stay in your environment. Anything we must hold temporarily on our side is encrypted and deleted at delivery.
- At the end, we confirm deletion in writing, along with a list of any residual access to be revoked.
- Books-and-records. Tools that generate investor communications or research are built so that outputs land in your existing archiving and recordkeeping systems, not in a separate store.
Compliance frameworks
Our practices are mapped to the SOC 2 Trust Services Criteria for security, confidentiality and availability, and everything we build is designed to sit inside your firm's existing SEC, FCA or equivalent compliance program rather than beside it.
- Vendor due diligence. We complete your DDQ or vendor questionnaire in full, and we're happy to speak to your outsourced compliance provider or fund administrator directly.
- Third-party tools we recommend are assessed on the same basis: data location, retention terms, training policy, SOC 2 or ISO 27001 status, and contract terms. That assessment is part of every build-or-buy call.
- Your AI use policy. If your firm does not yet have one, we draft it with you as part of the diagnostic, covering approved tools, prohibited data, MNPI handling and review.
Ownership and exit
No black boxes. Everything we deliver is transparent in both tools and method, and it is yours.
- You own the code. Plain, documented Python and configuration, delivered into your repository or account, with no proprietary framework and no licence back to us.
- You own the accounts. Cloud, model providers and any third-party tools are contracted in your firm's name.
- Leave whenever you like. Our support retainer is month to month. If you end it, everything keeps running and any engineer you hire can pick it up.
What we never do
- Hold a copy of your data on our own infrastructure after delivery.
- Use consumer AI accounts for client work.
- Train any model, ours or a provider's, on your material.
- Take referral fees from vendors we recommend.
- Reuse one client's documents, prompts or code for another.
- Trade in any name we've seen research on while under your policy.
Questions from your compliance team?
Send them straight to us. We'd rather answer them before the first workshop than after.
hello@mosaicmacro.com