AI · data control
One slice each,
never a pool
Every AI feature sees the minimum data its task needs, matching sub-transaction privacy end to end. There is no central pool of everyone's records for a model to sit on, because the architecture never assembles one.
01
Scoped at the source
A feature is handed the slice it needs — this account, this period — rather than being pointed at a warehouse and trusted to look away.
02
Structurally, not by policy
The forecasting path for one client physically cannot reach another's data. That is an architectural property, not a promise in a contract.
03
The honest trade
A single pool would train stronger models. We take the weaker-on-paper option, because for this client base a privacy guarantee is worth more than a marginal accuracy gain.
How the slice is drawn
ScopePer task, per account, per period
PoolingNone — no central store to query
Cross-clientUnreachable by construction
RailsSub-transaction privacy on the rail itself
TrainingNever on client transaction data