What customer or bank data ever leaves our MiOpsAI tenant?

Nothing customer-identifiable or bank-confidential ever leaves your MiOpsAI tenant. Operational data (names, email addresses, meeting notes, project statuses, vendor coordination threads, marketing content) is encrypted at rest with per-tenant AES-256 keys and stays inside the isolation boundary. Other MiOpsAI customers cannot see any of it, and we do not train shared AI models on your tenant data.

The two exceptions to "nothing leaves" are the ones every SaaS product carries and both are opt-in and scoped:

AI drafting. When LizziAI drafts a response to an operational message, the prompt is sent to the underlying model provider (OpenAI and Anthropic under enterprise contracts that prohibit training on your data and provide zero-retention APIs where available). We do not send account data or transaction data because we do not have any. The prompt contains the operational message content (the email or note), your practice voice guidelines, and the load or case context. No SSN, no account number, no balance, because none of that exists inside MiOpsAI in the first place.

Delivery. When you send an email through MiOpsAI, it goes out through SendGrid or your configured SMTP relay the same way any email client sends. That is delivery, not data sharing, and the content is the same content you would send from Outlook.

Everything else stays inside the tenant. Backups are per-tenant. Access logs are per-tenant. If you ever cancel (60-day written notice to billing@miopsai.io), we provide a full export of your tenant data and then delete it on the schedule agreed in the contract.

See the security and compliance FAQ set for the full data-flow diagram and the current SOC 2 status.