Every fund now has a line on its website about AI. It usually names a model. It is meant to be reassuring: a known name, a big company, a published policy. And it tells a founder almost nothing about what happened to their data.
The same weights, two different answers
Take one model. Run it through a zero-retention deployment in an EU region under an enterprise agreement, and it is a reasonable place to send a customer contract. Run the same weights through a consumer endpoint with standard retention and a training opt-in you forgot to change, and it is not. Same model name on the website. Two different answers to the only question that matters: may this touch the cap table?
So the model is not the safety boundary. The endpoint is: a provider, a region, a retention policy and a contract, taken together. That is the thing you can clear for a class of document, and the thing you can point to afterwards.
What we did about it
In Navent, clearance lives on the endpoint and nowhere else. You register each deployment you use, with its region and retention policy, and you say the highest sensitivity class it may receive. Routing is the comparison between a file's class and an endpoint's clearance, done before anything is sent, and shown to you in the plan.
The consequence is that "we use Claude" becomes a sentence you never need to say. What you say instead is: Confidential material goes to this deployment, in this region, with zero retention, under this agreement, and here is the log line. That is an answer.
The class no endpoint can hold
One more thing falls out of putting clearance on the endpoint. You can define a class above every clearance. We call it Sealed. No endpoint has sealed clearance, not ours, not yours, not any model anywhere, so there is no configuration under which a sealed document reaches a model. It is not a policy. It is a hole in the routing table, on purpose.
When a founder asks, that is the sentence they actually want to hear.