Information flow
Identify documents, prompts, outputs, retrieval indexes, logs, backups, support exports, and external service calls. Establish what the assignment actually needs.
SECURITY & PRIVACY / FOR YOUR COMPANY
Important information.
Clear boundaries.
Understand what an AI assignment can access, where information is processed, and which decisions remain yours. Start with the safeguards your company needs, not a blanket promise.
AGREE ON THE REQUIREMENTS. ASK FOR THE EVIDENCE.
Know the information path.
Define the authority.
These are questions to resolve for your chosen workflow or dedicated deployment. They are not a claim that every configuration provides the same controls.
Access & permitted actions
Review connected accounts, user roles, approved sources, and actions. Test that restricted information and prohibited operations remain outside the intended scope.
Evidence & review
Inspect sources, dates, uncertainty, and relevant tests. A fluent answer or completed plan is not proof that every fact is correct.
Retention & data use
Confirm what is retained, who may inspect it, permitted uses, deletion, and exceptions in the applicable service policies and agreements.
Change & support
For a dedicated deployment, establish update approvals, patching, re-evaluation, rollback, and support access, including who is responsible for each.
Recovery & continuity
Keep usable work and a fallback process. Agree on backup, recovery, incident response, and exit requirements for the environment you use.
Local project records.
Core project state and generated files are stored locally, supporting continuity and portable deliverables. Storage location is one part of information handling.
Storage locationPossible external processing.
Requested AI, web, media generation, calling, and connected-app operations may transmit relevant information to external services.
Processing & disclosureLocal-first does not mean entirely local. It does not promise that every feature works offline or that every provider has zero retention. Dedicated private deployments are separately scoped; confirm actual network dependencies and data handling before use.
A REVIEWABLE WORKFLOW
Set the scope.
Keep the work visible.
Thaddeus capabilities help you organize, inspect, and supervise work. Availability depends on platform, permissions, accounts, and services.
Plans & review points
Define the assignment and compare delivery with the approved scope. Plans support discipline, not a guarantee against errors or hallucinations.
Explore plans ↗Browser handoff
A separate working browser lets you inspect a page and take over when needed. Websites remain external services with their own information handling.
Explore browser work ↗Project continuity
Keep relevant records and deliverables for later review and continuation. Check retrieved information rather than assuming perfect recall.
Explore project memory ↗Supervision & stopping
Review progress and use available stopping controls. A stop request does not undo actions that already completed.
Explore supervision ↗Source-based research
Inspect excerpts, counter-evidence, and claim classifications. Important facts and conclusions still need review.
Explore research ↗Reviewed outputs
Check files, facts, calculations, rights, and recipients before sharing or relying on a deliverable.
Explore deliverables ↗Authorization can cover actions within an agreed scope; every individual step is not necessarily prompted again. Review the active permissions and consequential actions before delegating work.
A PRACTICAL FIRST EVALUATION
Start with a bounded task.
Evaluate the actual result.
Use synthetic or appropriately approved information. Regulated or highly sensitive data requires expressly agreed written safeguards and suitable technical controls before submission.
This is a discussion checklist. Checking a box does not change product permissions or record an approval.
PRIVATE DEPLOYMENT REQUIREMENTS
Bring your standards.
Agree on the fit.
A private LLM engagement defines a particular environment, information path, and operating arrangement. It is not automatically the same as a standard desktop subscription.
Agreements & assurance
Request relevant assurance evidence and assess its actual scope. Establish data-processing, access, support, retention, and recovery requirements in writing.
Information suitability
Assess the workflow and applicable obligations before using sensitive data. Local storage or an on-premises label does not establish regulatory compliance.
Output & disclosure
Eligible exports have no added Thaddeus branding. That does not remove metadata, service logs, rights restrictions, or legally required disclosures, and it does not guarantee anonymity.
FOR SMALL AND MIDSIZED BANKS
Banking-specific requirements.
A dedicated evaluation.
Explore customer-data boundaries, bank-owned hardware, policy support, examination evidence, and the operating commitments to establish for your institution.
READ THE SOURCE
Standard desktop agreements.
These published agreements describe the current desktop service. They do not replace separately agreed commitments for a private deployment.