Business-grade AI accounts only
Cloud AI is configured on business or enterprise tenants with model training disabled and the shortest available retention. Personal accounts are never used for client work.
Security & Privacy
Your data stays yours.
We are a security practice that builds AI, not the other way around. These are the standards every engagement follows.
Data-handling standards
Standards we apply on every engagement
AI gateway with logging
Requests pass through a gateway that records who asked what, applies policy, and routes sensitive requests to on-prem models. Logs stay under your control.
Least privilege and MFA
Assistants can only read the folders their users can already read. Every admin and user account we configure requires multi-factor authentication.
Encryption in transit and at rest
TLS on every connection; full-disk encryption on AI servers and laptops we configure; encrypted, tested backups.
No client data in demos
Public demos run on fictional sample data behind an API gateway with authentication, rate limits and hard spend caps.
Documented handover
You receive network diagrams, account inventories, configuration records and runbooks. You own them.
On-prem option
When data cannot leave the building
Our default is hybrid: cloud AI for general work, and an on-prem AI server in your office for anything confidential. The on-prem server runs open-weight models locally, indexes your file share without copying it to the cloud, and sits behind your firewall with single sign-on.
For offices that want nothing to leave, we can configure the server with no outbound internet access at all, updated during scheduled maintenance windows.
Compliance approach
Built around New Mexico law
The New Mexico Data Breach Notification Act (NMSA 1978, §§ 57-12C-1 et seq.) requires businesses that hold personal identifying information about New Mexico residents to maintain reasonable security procedures, to notify affected residents within 45 days of discovering a breach, and to notify the Attorney General when more than 1,000 residents are affected. It also requires that contracts with service providers include security safeguards.
We design engagements so you can meet those obligations:
- Our service agreements commit us to reasonable security procedures and prompt notice to you of any incident.
- Assessments produce a data inventory and risk register you can use as evidence of reasonable security.
- We help you write a one-page incident response plan with the 45-day notice clock built in.
- For CPA, tax and insurance offices subject to the FTC GLBA Safeguards Rule, we map controls to its requirements.
This page describes our practices. It is not legal advice. Talk to your attorney about your specific obligations.
Vulnerability disclosure
Found a security issue?
Email info@southwestblueprints.com with a description and steps to reproduce. We acknowledge reports within three business days. Please give us reasonable time to fix the issue before public disclosure, and do not access data that is not yours, degrade service, or run automated scans against client systems.
Machine-readable contact: /.well-known/security.txt
Next step
Not sure where you stand?
Our Security Audit is available on its own, with no AI purchase required. You get a prioritized remediation plan in one to two weeks.