01 — At rest
Stored and unreadable
Encryption and key management done properly — so a breach yields nothing usable, and your keys aren't a single point of failure.
Data protection · Private AI
Your data doesn't have to leave the building to be useful.
I help regulated organizations protect their sensitive data — at rest, in transit, and now in use — so they can adopt AI and modernize without failing an audit or opening a new hole.
The problem, plainly
Everyone's being told to adopt AI. Almost no one's been told what it does to their data.
The moment sensitive data leaves your control — to a chatbot, an API, a third-party model — you've created an exposure your encryption and your compliance posture never accounted for. Most teams find that out during the audit, not before it.
You don't have to choose between moving fast and staying protected. You just need someone who understands both halves of the sentence.
The whole picture
Data lives in three states. I protect all three.
02 — In transit
Protected in motion
Data safeguarded as it moves between systems, partners, and clouds, with no gaps where it briefly travels in the clear.
03 — In use
The new frontier
AI on infrastructure you control, so your people get powerful tools and your sensitive data never leaves the walls.
Most consultants can speak to one of these. The point of an enclave is that they're one continuous problem.
What I do
Three ways to work together.
Private AI Readiness Assessment
A fixed-scope, fixed-price engagement that answers one question clearly: can we run AI on our own data, how, and what will it take? You get a plan, not a sales pitch.
Encryption & Key Management Advisory
Encryption architecture reviews, key management strategy, HSM guidance, and post-quantum migration readiness — the unglamorous work that keeps you compliant and keeps auditors satisfied.
Ongoing Security Advisory
Senior security judgment on call, without the cost or commitment of a full-time hire.
Who this is for
Organizations where “where is our data right now?” has real consequences.
Regulated mid-market organizations — healthcare, financial services, legal, government contractors, and anyone else holding data that matters.
If you have sensitive data, a compliance obligation, and a growing pile of pressure to do something with AI, we should talk.
Why me
Thirty years protecting data — and I've built the private-AI stack myself.
A career across military communications, systems and network engineering, security operations, and enterprise data protection — with a CISSP and a specialization in encryption, key management, and hardware security modules.
And unlike most people advising on private AI, I run the stack myself: real language models on local hardware, no data leaving the premises. When I tell you it can be done, it's because I've done it.