Perspective

Private by architecture, not promise

The compliance question is not whether to use AI. It is where the model runs.

Roger Dunn, CTO · June 2026

TL;DR

Natural-language query never needs the data itself – only the schema and the question – so the only real question is where the model runs. A local model keeps everything inside the perimeter, which answers the compliance objection and the cost one at once.

A biostatistician at a pharmaceutical company opens Excel. She has a question about this quarter’s adverse-event reports, and it is exactly the kind of question natural-language query was built for: she would like to type it in plain English and get a governed answer back in her workbook, without writing SQL. Her firm runs a modern data platform. The natural-language feature is right there in the product. She still cannot use it.

Her question references patient data, and her firm has an absolute policy: regulated data does not leave the company’s perimeter, and that policy names external AI endpoints explicitly. The platform’s assistant runs as the vendor’s cloud service; using it would route her work through exactly the kind of external AI path the policy forbids. For her, that is the end of the conversation.

She is not an unusual case. The same wall stands in front of the analyst at the regulated bank, the audit firm, and the pharmaceutical company holding patient data. For each, the question is not whether to use AI. It is where the model that serves them is allowed to run.

The policy is not caution. It is the job.

A blanket prohibition on external AI is not institutional timidity. For these firms, it is a direct expression of what they are obligated to protect.

A bank holds material non-public information, customer personal data, and positions whose disclosure carries supervisory consequences. An audit firm holds client working papers under confidentiality and independence obligations. A pharmaceutical company holds patient data governed by HIPAA and GDPR, trial data, and intellectual property whose premature exposure can end a program. The prohibition is written down, audited, and attached to someone’s personal accountability. It is not relaxed because a compelling feature arrives.

The objection is that this prohibition is already dated. Many regulated enterprises now run enterprise editions of commercial AI – ChatGPT Enterprise, Copilot, and others – under contracts that bar training on customer data and specify retention and residency terms.

For most enterprise work, that is enough. It is not enough for the most stringent workloads – patient records, audit working papers, material non-public information – where the question is not whether a contract governs the data at the provider, but whether the data leaves the perimeter at all. For that work, the relevant question is architectural, not commercial: where does the model run, and what does it see?

What a platform assistant requires of the regulated analyst

The cloud platforms each ship a capable natural-language assistant. Genie runs in Databricks, on Databricks compute, against Databricks’ catalog and model policies. Cortex Analyst runs in Snowflake, on Snowflake compute, under Snowflake’s. Copilot for Fabric runs in Microsoft. Each is good at its job, and each is bound to the platform it ships with by the same commercial logic that makes any vendor reluctant to turn its premium AI into the front door to a competitor’s data.

For the regulated analyst, the binding property is not quality. It is location. The platform offers natural-language query only through its own assistant, which is the vendor’s model running as a cloud service, with no version she can run inside her firm’s perimeter. Using it means routing regulated data through an external AI path her firm has ruled out. Her firm’s line is that data does not leave; the assistant gives her no way to honor it. That disqualifies it for her workload, independent of how well it performs for everyone else.

This will not change. A cloud platform has every incentive to make its assistant excellent on its own data and to make adoption of that assistant a path toward consolidating more workloads on its platform. It has no incentive to build an assistant that runs locally on the analyst’s machine, with no telemetry back to the platform, that bypasses its own AI services entirely. The regulated analyst is structurally unserved by the platform assistants, and improving them does not address her.

The fact that reframes the problem

How natural-language query actually works changes what the privacy question is.

To translate a plain-English question into SQL, a model needs two things: the schema – the table and column names, their types, and their relationships – and the question itself.

It does not need a single row of data.

The model reads the schema, reads the question, and writes a query. That query runs against the platform’s own SQL engine, under the platform’s own governance, and the results return to the workbook. By the time any data is touched, the model is already out of the loop.

That changes the privacy question. The rows – the sensitive payload – never go near the model under any configuration. What is left is narrower: the schema, the question text, and where the model that reads them runs. Location is a deployment choice the firm makes, not a behavior it has to take on faith.

Flowchart illustrating the process of using Exponam Analyst Intelligence within a cloud data platform, detailing steps from SSO authentication to data written to an Excel worksheet.

Three postures, and the firm chooses

Exponam Analyst Intelligence treats the location of the model as a configuration, not a fixed property of the product. There are three postures, and which one applies is the firm’s decision, made against the firm’s own policy.

The default for the strictest environments is a fully local model. A SQL-specialized model runs on the analyst’s own machine. No data, no schema metadata, no question text, and no tokens leave the network. Models from 8 billion to 32 billion parameters are supported: an 8B model runs efficiently on a standard corporate laptop, and 14B or 32B models deliver near-instant responses on a GPU-equipped workstation. Model files are sourced from Hugging Face and verified as untampered before the application loads them. There is nothing to contract for, because nothing leaves.

For firms that have already vetted and approved a commercial provider – OpenAI, Anthropic, or another – a commercial-model configuration is available. Only schema metadata is sent to the provider; row-level data is never transmitted. This is for the firm that has decided, deliberately, that schema-level exposure under an existing agreement is acceptable. It is an option the firm elects, not the default it has to opt out of.

For firms that can use neither, natural-language query can be switched off entirely. The analyst keeps full governed access through the direct-SQL scratchpad and the visual data builder, neither of which involves a model at all. The capability meets the policy as it stands, rather than asking the policy to bend to the capability.

The cost question

This architecture matters for a second reason that has nothing to do with compliance. In May 2026, Uber’s president and chief operating officer, Andrew Macdonald, said the company’s AI spending had become “harder to justify,” after Uber’s chief technology officer disclosed that the company had burned through its 2026 budget for AI coding tools just four months into the year. Around the same time, Microsoft began canceling most of its direct Claude Code licenses. The management response has been consistent: cap per-seat spending, route work to cheaper models, and restrict which employees may use the most capable models at all, on the basis of role and cost rather than need. Natural-language query is metered no differently. Every question an analyst puts to a commercial model is billed by the token, and at enterprise scale that becomes a cost a manager weighs against who should be allowed to ask.

A local model removes the line item. The posture a regulated firm adopts to keep data inside its perimeter – a model running on the analyst’s own machine – also carries no per-query cost, because no tokens are billed to anyone. A firm can cap or withdraw access to commercial models as tightly as its budget demands, and its business users still get natural-language query through a local model, at no marginal cost per question. The cost control the firm wants and the capability the analyst needs stop being in tension. The firm that deployed locally for compliance gets that outcome for free; the firm acting only on cost reaches the identical result.

No data transits Exponam

The AI posture is not a special case; it is how the whole product behaves.

Exponam Analyst Intelligence is installed software, not a hosted service. No data, no schema, and no query transits Exponam-controlled infrastructure at any point. The product is a direct path between the firm’s cloud platform and the analyst’s machine, with no intermediary in between and no query log living in a vendor’s system. For an infosec review, this narrows the relevant attack surface to the firm’s own cloud platform and its own endpoint, with no third party added to the diagram. Exponam is not a processor of the firm’s data, which narrows the scope of a vendor-risk assessment correspondingly. The product’s architecture, data flow, authentication model, and secure-development attestation under NIST SP 800-218 are documented in the Security Center for the teams who review such things during procurement.

Closing

The platform assistants will keep improving. Contracted enterprise-AI offerings will broaden, and some regulated firms will widen what their policies permit. None of that changes the case of the firm whose line is drawn at the perimeter, because that firm’s requirement was never about the quality of the model or the terms of the contract. It was about location.

The biostatistician does not need a stronger promise about how her data will be handled once it leaves. She needs it not to leave.

An independent tool that runs the model where her firm allows it to run can give her that. A platform-bound assistant, by the structure of the business that builds it, cannot.

The cost case ends where the compliance case does. When a firm moves to limit commercial-model use – to hold a compliance line or to contain cost – a local model for natural-language query lets its business users keep the productivity gain with no per-query cost. Compliance and cost arrive at one configuration.

Where the model runs is the whole question. Letting the firm answer it is what we built.