The Data Never Leaves the Box

The whole thing runs on one machine. MAX is a local-first AI resident, a single program that lives on one workstation inside the owner's own walls and does its thinking there. Speech recognition, the language model, the memory, the face and voice recognition, all of it runs on that box. Nothing from a conversation gets shipped out to be processed somewhere else.

That one fact is the most valuable property the architecture has. It matters most in the two places where data is hardest to hold, healthcare and finance.

Nearly every rule in both domains reduces to three questions. Where does the regulated data live, who can reach it, and how little of it can a task touch. A system that never sends that data to a third party answers the first question by the way it is built. It shrinks the other two. There is no outside processor to vet, no border for the data to cross, and no shared tenancy for a single breach to run through.

Most AI products work the other way. The user's data ships out to servers the vendor runs, gets processed there, and the vendor becomes a link in the customer's own compliance chain. That one design choice pulls in the heaviest machinery a regulated buyer has to account for.

There is a trap in writing this down. Once you have built the system, every design choice starts to look prophetic in hindsight. A compliance story told by the person who built it is the least trustworthy version of that story. So every claim here points back at the part of the system that backs it. A builder grading his own homework is the last witness a regulator should trust. Naming the source is the only honest way to hand the grading to someone else.

Where the data lives

Start with where the data lives, because that is the choice everything else hangs on. The first rule of the system is local-first, and it runs all the way down. Inference, memory, and perception all happen on the customer's box. A cloud model is available as an opt-in accelerator, gated behind a key, and it is never the default path. The one channel that leaves the box carries a metrics-only digest, which means counts, timings, and health signals, and never the content of anything.

For a hospital or a clinic, the vendor's side of that arrangement is designed to hold no protected health information at all. Protected health information, or PHI, is the patient data that HIPAA guards. HIPAA is the U.S. health-privacy law that sets the rules for handling it. The digest is built to carry none of it.

That is a different starting line from any cloud AI. There, the first task is papering the vendor into the chain of custody as a business associate. That term names a vendor a provider trusts with PHI, one that then inherits the provider's legal duties over it. Here there is no processor holding the data, so there is no business-associate chain to build and no sub-processor to oversee.

The HIPAA safeguards, in code

HIPAA spends most of its Security Rule on technical safeguards, and the system carries real ones.

Access is per user. Each resident is known by name and by voice and face, and sensitive operations sit behind a PIN. The PIN is hashed on disk with SHA-256, a one-way scramble that cannot be turned back into the original. The stored value is never the PIN itself. It is rate-limited to three attempts a minute, with a lockout after that. A running audit log records security events and any action the system takes on its own. Every stored fact carries its source and a confidence level, which is the integrity control the rule asks for. Network transmission stays localhost-only by default, so nothing on the machine listens for inbound connections at all.

The rule also asks that a system survive its own failures, and this is where most products fall back on a policy binder. This one ships the machinery instead. A watchdog restarts the backend when it dies. Repair and self-heal routines bring failed parts back on their own. When a build goes bad, the system rolls back to the last known-good one without being told to.

The line the FDA drew

The sharper regulatory point is where the medical layer sits on purpose. Software that gives a clinician a recommendation they can independently check stays outside medical-device regulation. That is the clinical-decision-support carve-out written into the 21st Century Cures Act. Clinical decision support means software that helps a clinician reason, as against software that makes the call for them. Cross that line into a directive the clinician is expected to simply follow, and the software becomes a regulated device.

The medical layer is built to stay on the safe side of that line. It wraps every answer as a sourced claim. It names the source, gives the date the source was retrieved, states what the evidence says, and attaches a confidence level. The question it answers is what the evidence says about something, and not what the patient has. The clinician always sees why the system said what it said, and where it came from. That visibility is the independent review the carve-out is built around. A hard ceiling in the code refuses to let the system act on high-stakes decisions at all. It observes, it recommends, and past that it raises an error rather than proceeding.

MARA inherits the foundation

MARA is the healthcare specialist all of this is headed toward, with MAX as its proving ground. MARA, the Medical Algorithmic Resident Assistant, is the clinical version of the same system. The point of everything above is that MARA does not open on a blank compliance slate. It inherits a data plane that never sends patient data out, and a knowledge base where every fact carries its source. It inherits a medical vocabulary drawn from authoritative public references, and the same hard ceiling on high-stakes action. The groundwork that usually sinks a healthcare AI is already the shape of the system it grows out of.

The same discipline, applied to money

Finance rhymes with all of this. The Gramm-Leach-Bliley Act, the U.S. law covering consumers' financial information, carries a Safeguards Rule that reads like a security checklist. The system answers most of it with the controls it already uses for health data. Access sits behind the PIN and per-user identity. On every code change, the build runs two scans. One reads its own source for security flaws, the other checks outside libraries for known vulnerabilities. Logging and reversibility cover change management. The sub-processor oversight the rule wants is simply absent, because there is no processor at the data layer to oversee.

Finance has a line that matches medicine's do-not-diagnose line. You cannot give someone personalized investment advice without a license. The SEC and FINRA, the two bodies that police the securities markets, draw and enforce that line. The system treats it the way it treats a medical question. It explains an instrument, defines the terms, shows the math, and surfaces what the sources actually say. Every answer is tagged by where it came from and how sure it is. It stops short of telling a specific person to buy a specific thing. The same grounded-honesty rule that keeps it from overclaiming on a medical fact keeps it from overclaiming on a financial one.

Card numbers stay out of scope entirely, because the system never handles one. That is the cheapest and safest place to stand under PCI-DSS, the card-industry security standard. In the EU, the operational-resilience rule for finance, known as DORA, leans on the same self-healing and no-outside-processor design the architecture already has.

The frameworks a security team names first

Then there are the frameworks a security team asks about before it signs anything. SOC 2 organizes its whole review around five properties: security, availability, confidentiality, processing integrity, and privacy. It is the attestation North American buyers ask for most. The controls already in the system map onto all five without much stretching. Localhost-only defaults, the PIN, the two code scans, and reversibility cover security. The watchdog and self-heal stack cover availability. Local-first handling and per-user isolation cover confidentiality. Source and confidence on every fact cover processing integrity. Default-private handling, where one resident's private facts are fenced out of the shared memory so they can never surface for another, covers privacy.

The quieter strength is the supply chain. Every outside library the system depends on is recorded with its license. A gate in the build rejects any license hostile to shipping a commercial product. Copyleft licenses like GPL and AGPL can force a company to open-source its own code as the price of using them. The gate treats those as landmines. That single discipline answers a supplier-control requirement found in both ISO 27001 and NIST guidance, the security standards enterprise buyers name most often. Most shipping products do not carry it.

The founding rules, read as controls

The most useful way to see all of this is to read the founding rules as a control framework. That is what they turned into. Local-first is data residency. Source-and-confidence on every fact is the anti-hallucination control for regulated claims and the FDA's review-the-basis criterion at the same time. Default-private handling is the minimum-necessary and access-isolation control that both HIPAA and GLBA want. Reversibility with an audit trail is change management. The rule that matters most for regulated work is the ceiling on high-stakes action.

That ceiling is enforced in the code, not by good intentions. The control authority lets the system observe freely. It can act on its own only where an operation is safe, reversible, and audited. Past that it can recommend and nothing more, and an attempt to cross the line raises a violation instead. That is the exact mechanism both the clinical carve-out and the investment-advice line are asking for, and it runs on every action the system takes.

Compliance as the product's shape

The commercial shape falls out of the same choices. The offer is a managed private AI, kept healthy from a distance without the vendor ever reading a customer's data. The fleet is watched through metadata only, the same metrics digest that is the one thing leaving the box. Updates move through a staged, gated, reversible pipeline that ends in an automatic pull of the latest known-good build. For a compliance officer, the interesting part is what the vendor's systems never hold. They never touch customer health or financial data, so the vendor's own audit scope shrinks as the customer base grows, rather than swelling with it.

None of this is a certificate. Alignment with a framework is not an attestation, and the paperwork that turns substance into a signed audit has not been done. MARA still has a whole clinical-quality apparatus ahead of it. What is finished is the expensive part, the part that is hard to retrofit and easy to get wrong. The data stays on the box. The source rides along with every claim. The ceiling holds the system to recommending where it is not allowed to rule. Those got decided at the foundation, before there was an auditor in the room to decide them for. Certification, when it comes, will mostly be the work of writing down what the system already does when no one is watching.

Scope. This maps an as-built architecture against the leading healthcare and finance regimes and the common security frameworks. It is a technical analysis and not legal advice. Whether any given rule applies is a fact-specific question, and a real compliance claim needs a qualified lawyer and, where the framework requires one, a licensed auditor.

Glossary

AGPL and GPL. Copyleft software licenses. They let anyone use the code, but they can require a company that builds on them to release its own source code in turn, which is why a commercial product screens them out.

Audit log. A tamper-evident record of security events and of any action the system takes on its own, kept so that an event can be reconstructed after the fact.

Business associate. In healthcare, a vendor that a provider trusts with protected health information. The vendor inherits the provider's legal duties over that data, which is the chain a local-first system avoids by never receiving the data.

Clinical decision support, CDS. Software that helps a clinician reason toward a decision rather than making the decision for them. The distinction is what keeps such software outside medical-device regulation.

DORA. The Digital Operational Resilience Act, the European Union's rule requiring financial firms to keep running through technology failures.

FINRA. The Financial Industry Regulatory Authority, a U.S. body that oversees brokers and enforces the line against unlicensed investment advice.

GLBA. The Gramm-Leach-Bliley Act, the U.S. law protecting consumers' nonpublic financial information. Its Safeguards Rule reads like a security checklist.

HIPAA. The U.S. health-privacy law. Its Security Rule sets the technical safeguards for handling protected health information.

ISO 27001. The international standard for an information-security management system, often named alongside SOC 2 by enterprise buyers.

Local-first. A design where all processing happens on the customer's own machine, and regulated data never leaves it.

MARA. The Medical Algorithmic Resident Assistant, the clinical-specialist version of MAX.

MAX. A local-first AI resident that runs entirely on one workstation inside the owner's own walls.

NIST. The U.S. National Institute of Standards and Technology, whose cybersecurity and supply-chain guidance is a common reference for security programs.

PCI-DSS. The Payment Card Industry Data Security Standard. A system that never handles card numbers stays out of its scope.

PHI. Protected health information, the patient data HIPAA guards.

SEC. The U.S. Securities and Exchange Commission, the federal regulator of the securities markets.

SHA-256. A one-way cryptographic hash. A value hashed this way cannot be reversed back into the original, so a stored PIN hash never exposes the PIN.

SOC 2. An attestation, common in North America, that reviews a system against five properties: security, availability, confidentiality, processing integrity, and privacy.

Static-analysis and dependency scans. Two automated checks run on every code change. The first reads the system's own source for security flaws, the second checks the outside libraries it uses for known vulnerabilities.