Security should be easy to understand. You need to know where data goes, who controls it, and what is retained. For Charlie, the security story starts with three practical points: zero data retention, private cloud deployment, and an ISO 27001-certified foundation.

Zero data retention

This is the most important part. LLM providers do not retain customer prompts or responses, and customer data is not used to train their models.

Charlie keeps conversation data out of model-training flows. For example, Microsoft states that in Azure OpenAI / Azure Direct Models, prompts, completions, embeddings, and training data are not available to OpenAI or other customers, and are not used to train foundation models without the customer’s permission or instruction. Deployment choices still matter for data residency, networking, logging, and abuse-monitoring settings, so those controls should be reviewed during implementation.

For observability, you can also keep control of where trace data lives. Data can be stored on your own server through a hybrid or self-hosted Braintrust deployment, while the data plane stays isolated behind your own controls.

Private cloud

Charlie can run in your own cloud environment (cloud agnostic). This keeps data inside infrastructure you control and gives your security team clearer boundaries for networking, identity, access, and monitoring.

ISO 27001

InvestSuite is built on an ISO 27001-certified security foundation. That gives your review teams a familiar baseline for enterprise security assessment.