Last week we wrote about the idea of a screening gate between untrusted input and your AI agents: a fast categorization model that reads the email first, decides what it is, and flags anything that smells like instructions. The response we heard, from people running systems in finance and healthcare, was a version of the same question: could this keep sensitive data away from the big language models entirely?
The logic is appealing. Jev, the categorization model from TypeSafe AI, is priced at $0.042 per million input tokens and answers in under half a second. If a cheap, fast model can classify an email or a support ticket, extract nothing sensitive, and pass along only a category and a confidence score, then the full conversation never needs to leave your boundary. For a credit union or a clinic, that inverts the usual AI privacy problem: instead of asking whether a big LLM vendor can be trusted with nonpublic personal information, you keep the NPI local and send a five-character decision.
We like the architecture. We’re not ready to recommend it for regulated data, and the reasons are instructive regardless of which screening vendor you choose.
What the vendor has published so far
TypeSafe launched on September 15, 2026, and the paper trail is thin by design. The trust center, run on Vanta, publishes a controls inventory and lists SOC 2 Type II among its compliance resources, with the full report available on request. The data processing addendum is real and specific: EU standard contractual clauses, subprocessor notice periods, a commitment not to sell or share personal information under CCPA definitions. The privacy policy states customer inputs are not used to train or fine-tune models.
Now the parts that give us pause. Retention is “as long as reasonably necessary to provide the Services,” not a zero-retention commitment. A third-party routing registry currently lists Jev’s zero-data-retention posture as “not established.” And the subprocessor list includes Modal, an AI infrastructure provider, where prompts are processed but not stored. That’s a reasonable engineering choice, and “not stored” on a subprocessor still means your data transits and executes on systems TypeSafe doesn’t operate.
What a regulated buyer actually needs in writing
Regulators don’t grade effort. The FTC’s Safeguards Rule requires financial institutions to oversee service providers, and HIPAA requires a business associate agreement before a vendor touches PHI. Neither framework accepts “the trust center says they’re working on it.” For a gate model positioned in front of NPI or PHI, the checklist looks like this:
- Data residency. Named regions for processing and storage, with a contractual commitment, not a marketing page. The DPA describes transfers; it doesn’t pin them to jurisdictions you can defend to an examiner.
- Zero retention, in the contract. Prompts and outputs deleted after the response, with a retention schedule you can cite. “As long as reasonably necessary” is a consumer-app posture, not a regulated-systems posture.
- Training use, contractually excluded. A privacy policy statement is weaker than a contract term, and both should say no training on customer data, full stop, no exceptions for abuse monitoring unless you agree to them.
- Subprocessor transparency and flow-down. The DPA covers this, and you should still read the subprocessor list and ask what “processed but not stored” means operationally: where does the data sit during processing, who can access it, what are Modal’s retention guarantees?
- A signed BAA for PHI. HIPAA requires a written business associate agreement before a vendor handles PHI, and HHS publishes sample provisions and enforcement guidance but does not certify or list “HIPAA-compliant” vendors. TypeSafe offers no BAA that we could find. No BAA, no PHI, no exceptions.
- Audit rights. The ability to verify controls yourself or via a third party, not just read a dashboard.
The architecture still works. The order of operations is what matters
None of this is a verdict on Jev or on TypeSafe, which is three days into public life as we write this. The screening-gate pattern remains one of the better ideas in applied AI security: put a cheap, fast, typed-output model between untrusted content and your expensive, chatty, credentialed agents. For general business content, there’s no reason to wait.
For regulated data, the sequence is fixed. First the vendor produces the contractual assurances, the completed SOC 2, the residency commitments, the zero-retention terms, the BAA where PHI is involved. Then, and only then, the gate gets wired in front of systems that handle NPI or PHI. A gate that leaks is worse than no gate, because it reads everything.
The good news is that this is now a checkbox exercise instead of a research project. Vendors in this space respond to buyer pressure, and the buyers who ask these questions in writing are the reason the answers exist.
If you’re evaluating an AI vendor against a regulatory checklist, that’s core to our managed AI services work. We’ve written before about the seven questions to ask any AI vendor; this post is what it looks like when you ask them of a brand-new one.