Security and deployment
Elvet holds privileged material, so the architecture assumes the strictest case first: a firm that will not let its documents onto someone else's infrastructure. Everything else is a relaxation of that, never a retrofit onto it.
Nothing a firm uploads is used to train a model — ours or anyone else's. Where a hosted model is used to classify or locate text, it runs against an endpoint contracted for zero retention, so nothing persists on the provider's side.
Documents, extracted facts, the event log and the graph are the firm's. Export is not a negotiation, and leaving does not mean leaving anything behind.
Tenants are separated at the database, not by a column in a shared table. There is no query whose predicate is the only thing standing between two firms' documents.
Access is granted at the matter and inherited by everything in it, with per-document exceptions where a matter genuinely needs them. Search respects it: a document you cannot open is a document you cannot find.
What a model classified, what a person adjudicated, what was overridden and by whom — all of it is on an append-only log. The record answers "why does it say that?" months later, without anyone reconstructing it from memory.
Elvet is designed to run as a single-tenant appliance inside a firm's own boundary, with inference in the same boundary — the hosted service is the same system with one tenant per firm rather than a different product. If an air-gapped deployment is what your risk function requires, that is a conversation to have early rather than a roadmap item to discover late.