Outsourcing AI Development Without Your Data Leaving: How an Outside Team Works Inside Your Systems

An outside firm can build and run an AI system on documents that must not leave your company. The documents stay on your servers, and the firm's engineers reach them through accounts you issue and can switch off, from machines you control. They build on sample documents your team has approved and work with real documents only on your servers. To find a firm that can work this way, ask how its engineers reached a past client's documents and what the firm deleted at the end.

Can an outside firm build our AI system if our data must not leave?

Yes. Where the language model runs is a separate decision, covered in the closed-perimeter article linked above. This article is about the people who build the system and what they can see and copy. A model on your own servers protects little if an engineer saves a folder of real documents to a laptop to test a prompt (the instructions the model follows).

Does an engineer who only reads our documents count as the data leaving?

Under EU data protection law, even reading personal data counts as processing. Article 4(2) of the GDPR defines processing as any operation performed on personal data, and its list includes “consultation”, that is, looking at the data. A firm whose engineers need that access to do the work is usually your processor, the GDPR's word for a company that handles personal data on your behalf. Article 28 requires a contract or another binding legal act with a processor.

If the firm is based outside the European Economic Area, its remote access is a transfer of the data abroad, even if the data only appears on a screen. The European Data Protection Board, which brings together the EU's data protection authorities, says so in its Guidelines 05/2021.

A transfer needs a legal ground under Chapter V of the GDPR. One is an adequacy decision, by which the European Commission finds that the firm's country protects personal data well enough. Another is the standard contractual clauses, ready-made contract terms the Commission adopted on 4 June 2021. Before relying on them, the parties assess the laws of the firm's country, as the Board's Recommendations 01/2020 describe.

In the United States, the Federal Trade Commission's Safeguards Rule covers financial institutions the FTC oversees, such as mortgage lenders and payday lenders. They must take reasonable steps to pick service providers that can protect customer information, write those protections into the contract and check the providers from time to time. They must also use multi-factor sign-in for “any individual accessing any information system”, unless their security lead approves reasonably equivalent or more secure controls in writing. Ask your counsel which of these rules apply to you before anyone outside gets access.

How do outside engineers get access without taking data out?

Give them access the way you give it to staff, with tighter limits:

• A named account for each person, created in your own systems, with multi-factor sign-in. With a shared login, the logs cannot show which person opened which document
• One place to work: a virtual desktop, a computer on your servers that the engineer sees only as a screen. A laptop your company manages also works if it opens documents only through that desktop. Block copying of files and text to other devices
• Access by role, with real documents behind a separate approval that has an end date
• Internet access from the work machines limited to what the work needs, so a document cannot be pasted into a public website or an online chat tool
• Sign-in and file-access logs held by your security team, where the firm cannot edit them

Before the first engineer starts, ask someone on your side to get a document off the work machine by every route they can think of. Close every route that works, and repeat the test after each change to the setup.

What do outside engineers build on before they see real documents?

Much of the work does not need real documents. Most of the code, from reading incoming files to the screen where reviewers check answers, can be built on approved samples. Good samples are published documents of the same type and made-up ones generated on your servers from your own templates.

Real documents are needed for two jobs. One is the acceptance set: real documents labelled with the correct answers, which the system is scored against before each release. The other is adjusting the system on the cases the samples miss. Both happen on your servers, by people approved to see real documents.

Removing names does not always make a document anonymous, because an account number or a date and amount can still point to one person. Recital 26 of the GDPR says that pseudonymised data, where names are replaced but extra information could still link the data to a person, counts as personal data. So keep such samples on your servers until your data protection officer confirms they are anonymous.

Where do copies of our documents end up during a project?

A running system makes copies of its own, in logs and in the search index, and the article on AI pilots linked above lists them. Copies made by people while building are easier to miss:

• A sample saved to an engineer's laptop to test a prompt offline
• Screenshots and pasted passages in the firm's task tracker, chat or email, which stay in the firm's systems and backups
• Text pasted into an AI coding assistant or chat tool, which may send it to the tool's provider
• A test copy of the system in the firm's own cloud account, loaded with your data to save time
• An export made for a demo to your managers, then forwarded

Treat the search index like the documents. It stores each passage as an embedding, a list of numbers that captures its meaning, and many setups keep the passage text next to it. Research shows text can be rebuilt from the numbers alone.

At the EMNLP conference in 2023, Morris and colleagues rebuilt 92% of 32-token passages exactly (a token is a word or part of one). They worked from embeddings made by one open model and could query that model repeatedly. Exact recovery was lower for a commercial model and for longer passages. The same method recovered 89% of full names from a set of clinical notes.

Put it in writing that your documents and anything made from them, such as the search index or the acceptance set, stay on your systems.

Which tools may the outside engineers use?

Only the tools on a short list you agree with the firm for the machines that can reach your documents. To build the list, ask which AI coding assistants and online tools its engineers use every day. For each one, ask whether it sends the code it sees, or text pasted into it, to an outside provider.

If the team wants an AI coding assistant, connect it to a model inside your perimeter, the network and systems your company controls. Otherwise, install it only on machines that never see documents. The list goes into the contract, and adding a tool needs your approval.

What should the contract with the firm say?

For EU personal data, Article 28 of the GDPR lists what the contract must contain. Among other things, the firm acts only on your documented instructions, and everyone with access must keep the data confidential. The firm takes the security measures Article 32 requires, allows your audits, and brings in no other processor without your written permission in advance. When the service ends, the firm deletes or returns the data, as you choose, and deletes existing copies, unless EU or member state law requires it to keep them.

Projects like this need a few terms on top:

• The name and role of everyone with access, and the country each person works from
• Notice, within a period you set, whenever anyone joins or leaves the project
• No subcontractors without your written consent, even for documents with no personal data in them
• A signed confirmation at the end that no copies remain, covering laptops, accounts and backups

This is not legal advice, and your counsel drafts the terms for your jurisdiction.

What happens when someone leaves the project, or the project ends?

Access should end on the day the work does. The US standards agency NIST covers outside staff, including firms that develop systems, in control PS-7 of its security catalogue, SP 800-53. The control asks you to make the firm report, within a time you set, when anyone holding your logins or access rights moves to other work or leaves.

On the last day, your team disables the accounts and virtual desktops and collects any managed laptops. Change any passwords and keys the outside engineers knew on the same day, and get the firm's written confirmation of which copies it deleted and that none remain. Run the same steps when one engineer leaves a project that carries on.

How do we check a firm before it gets access?

Ask each firm on your shortlist for written answers, and compare them side by side:

• Describe how your engineers reached a client's documents on a past project with similar rules, without naming the client
• Say who would have access on our project, where they work, and whether they are employees or subcontractors
• Say what you will build on before you see real documents, and who approves the samples
• Show us a deletion confirmation you signed at the end of a past project, with the client's details removed

What are the warning signs in a firm's plan or contract?

• The firm asks for an export of your data to its own cloud “to get started faster”
• Engineers would share one login, or the firm cannot say who will have access
• The plan has engineers testing prompts with real documents on the firm's own laptops
• The contract is silent on subcontractors, or on copies at the end

Where does amBrain fit?

The one language model project amBrain describes in public is this: “We have taken an LLM integration to production inside a client's FinTech perimeter: extracting and normalising unstructured broker and venue notices — corporate actions, instrument and margin changes — into structured records the trading system consumes.”

This article is not a case study. The client is not named. The article does not claim that amBrain's engineers worked inside that client's systems or that the project used any of the setups above. It gives no prices or timelines.

amBrain has been building software since 2019. On ownership, amBrain's line is: “The client keeps full ownership of the product and the code, except our reusable components.” Ask amBrain for the list of those components by name before you sign, as you would ask any other firm.

Before you bring in an outside team for an AI system on restricted documents, put the questions above to every firm on your list.

Common questions

• Can the outside engineers work from their own office? Yes, if they reach your systems only through the virtual desktop or managed laptop and keep nothing on their own computers. If the firm is based outside the European Economic Area, that access is a transfer under EU rules, as described above
• Does this setup add work before the project starts? Yes. Accounts, work machines and approvals must be ready before the first engineer begins, so ask the firm early what it needs from your IT team
• Is a non-disclosure agreement (NDA) enough? No. A typical NDA covers secrecy, and many also require documents to be returned or destroyed at the end, though some let the firm keep copies in its backups. It does not set up named accounts, work machines or rules for subcontractors. For EU personal data, Article 28 also asks for terms an NDA usually lacks