Question 1

What is the difference between proof and a promise?

Accepted Answer

A promise is a SOC report, a contract, a policy. Proof is a hardware-signed attestation of what code ran, on which data, inside a genuine isolated environment, that anyone can check with public keys and arithmetic. Halten produces the second. Examiners can verify the record; they do not have to take our word.

Question 2

Does data leave the bank's environment?

Accepted Answer

No. The query is sent to where the data already sits. Content is not copied outside the perimeter, and processing happens inside a hardware-isolated environment in a US region.

Question 3

What can the Halten team see?

Accepted Answer

None of the content being processed. Hardware isolation prevents our team and the cloud provider from opening what is running. What stays visible to us is operational metadata — volume, latency and failures — never the content of a question or an answer.

Question 4

How does this sit with GLBA and SR 11-7?

Accepted Answer

Under the GLBA Safeguards Rule the bank remains responsible for customer information; we are a service provider, and the record we produce is the evidence of oversight the Rule expects. For SR 11-7, every answer carries what went in, what ran and who read it, which is the input trail model risk management asks for. Both export in a form your examiners already read.

Question 5

Do we have to change tools or train the team?

Accepted Answer

No. The answer arrives inside the Microsoft 365, Copilot and document management already in use. There is no new portal to maintain and no learning curve for the business.

Question 6

Which cloud does it run on, and where does the data sit?

Accepted Answer

Isolated execution runs on Azure confidential GPUs: NVIDIA H100s in confidential computing mode, attached to AMD SEV-SNP confidential VMs, in a US region, with data held in the United States. The architecture also supports deployment inside the bank's own Azure subscription where internal policy requires it.

Question 7

Do you train models on our data?

Accepted Answer

No. Content is not retained after the answer and does not feed training, fine-tuning or evaluation. What persists is the audit record, which does not contain the content itself.

Question 8

Who answers to the regulator if something goes wrong?

Accepted Answer

The bank remains responsible to its regulators, as with any third party it engages under OCC 2023-17. Our role is to supply the technical evidence behind that answer, and to be in the room when the conversation happens.

Join the waitlist.