Tek Tools stands up AI your team can actually use, deployed so your proprietary data never becomes someone else's training set. We run Claude and AWS models in Amazon Bedrock, self-hosted local LLMs, and managed Claude, OpenAI, and Gemini accounts, all connected securely to the systems you already run. We work with growing Orange County businesses right through to CMMC environments handling ITAR, EAR, and CUI data.
Somebody in your company pasted a contract, a customer list, or a drawing into a free chatbot last week to save an hour. They were not being reckless. They were being efficient with the only tool available to them, because nobody gave them a sanctioned one.
On a consumer tier, that text can be retained, reviewed by a human, and used to improve the model. Unpublished pricing, drawings, source code, and client details end up inside a system your competitors also use. There is no way to claw it back, and no record of what left.
If you also hold Controlled Unclassified Information or export-controlled technical data, the same paste is a different category of problem. Once ITAR or EAR data enters a commercial model's pipeline, you can no longer certify that no foreign person touched it, because logging, caching, temporary compute, and abuse review are all points where a non-US person could sit. Under ITAR, that is a deemed export.
Either way, the answer is not a memo telling people to stop. The answer is AI they are allowed to use, deployed somewhere you control.
We work out which one fits your data, then build and run it.
Frontier models running inside your own AWS account and VPC. Your prompts are not used for training and are not retained by the model provider. Private connectivity, encryption with keys you hold, and a full CloudTrail audit trail. For controlled work, the same deployment pattern runs in AWS GovCloud (US) regions, where Claude in Bedrock carries FedRAMP High and DoD IL4/IL5 authorization.
Best for teams that want frontier models without enterprise procurement.
Open-weight models running on hardware you own, on premise or fully air gapped. Nothing leaves the building, which makes the export-control analysis short and the answer easy to document. We size the hardware, deploy the serving stack, tune the models against your own documents, and maintain it.
Best for the strictest ITAR boundaries, and for high query volume where owned hardware pays for itself.
Team and enterprise accounts with the settings that matter: single sign-on and SCIM provisioning, training and retention switched off, admin policy and data loss prevention configured, spend controls in place, licenses right-sized, and your staff trained to use them. We keep running them afterwards.
Best for teams who want AI now, without their work becoming training data.
Three things decide it: whether your prompts train the model, how long they are kept, and who else can see them.
On business and enterprise tiers, and on any model running in your own cloud account, your prompts are not used to train the provider's models. We configure it, verify it, and show you the terms that back it.
Zero or short retention, logging you control, and no vendor-side human review of your content. What your team types stays inside your own tenancy.
No shared indexes and no cross-tenant retrieval. An agent sees your data and only your data, under the permissions your people already have.
Some technical data should never touch a network you do not own. For those workloads we deploy open-weight models on your own hardware, so the entire inference path sits inside your facility.
If your business handles Controlled Unclassified Information or export-controlled technical data, an AI system is not an exception to your compliance program. It is another system in scope, and it has to be treated like one. We already do NIST 800-171 gap assessments, CUI identification, System Security Plans, and POA&M work for Orange County defense contractors. Adding AI to that boundary is the same discipline applied to a new system.
An agent earns its keep once it can reach your real systems, under the permissions your people already have.
SharePoint, Teams, Outlook, and OneDrive connected through scoped service principals, so an agent can search and summarize what a given user is already entitled to see.
Drive, Gmail, and Docs wired in with domain-wide delegation kept narrow, so you can audit exactly what the agent is able to reach.
Model Context Protocol servers built against your line-of-business systems, so an agent can query the systems that run your company.
CATIA, ENOVIA, and 3DEXPERIENCE environments we already administer, so retrieval respects the part and project permissions your PLM enforces.
On-premise shares, network drives, and your help desk queue indexed for retrieval, so each person's results respect their own permissions.
Financial reporting and reconciliation workflows connected with read-scoped credentials, supported by the same in-house accountants who run our bookkeeping services in Costa Mesa.
You will also need documentation that holds up in front of an assessor, a prime contractor, or your own board.
A written AI policy your staff can follow, naming which tools are approved, for which data, and what always requires a human decision.
A clear line between what may go to a commercial model, what stays inside your boundary, and what never touches AI at all.
Single sign-on, group-based entitlement, and least-privilege service credentials, so agent access is provisioned and revoked with everything else.
Prompt and response logging with a retention period you chose deliberately, plus periodic review to catch unapproved tools creeping back in.
We start with one job worth automating, prove it out, then widen from there.
Where AI is already being used, what data you hold, what your contracts and compliance obligations allow, and where the hours are going.
Which delivery model fits which workload, what sits inside the boundary, and a fixed quote before anything is built.
One agent, one real job, one team, measured against how that work gets done today.
Ongoing management from our 24/7/365 team, every one of them a US person in the United States: monitoring, model updates, cost control, and the next workload once this one sticks.
Common questions about AI agents, keeping your data out of public models, and using AI with controlled data.
Not on the tiers we deploy. Business and enterprise accounts from Anthropic, OpenAI, and Google exclude your content from training by default, and a model running in your own AWS account never sends your data to the provider at all. We configure the setting, verify it, and show you the contract terms that back it.
Yes, and most of this work is not defense. The common thread is wanting AI without handing proprietary work to a public chatbot. The compliance engineering is there when you need it, but nothing about the setup requires it.
The consumer and standard commercial tiers of ChatGPT are not built for ITAR technical data. Prompts may be logged, cached, or reviewed, and any of those touchpoints can involve a foreign person, which is a deemed export. ITAR work needs a deployment where data stays in US jurisdiction under US-person access control, such as AWS GovCloud or on-premise hardware.
Yes, if the AI runs inside your CMMC assessment boundary. That means a deployment you control, with no training on your data, no vendor-side retention, encryption you manage, and audit logging. Claude in Amazon Bedrock on AWS GovCloud and self-hosted open-weight models are both workable paths. Public chatbot tiers are not.
Treat the AI system as in scope. Put it inside the boundary, apply the same NIST 800-171 controls you apply to any other system handling CUI, restrict access to authorized users, log everything, and document it in your System Security Plan. Then block the public tools your staff would otherwise reach for.
It depends on which Copilot and which tenant. Copilot in a commercial Microsoft 365 tenant is not appropriate for CUI. GCC High deployments can be, if they are configured correctly and documented in your SSP. The product name alone tells you nothing. The tenant, the data flows, and the configuration decide it.
An AI agent is a model given tools and permissions so it can do work rather than only answer questions: read a shared drive, draft a quote, reconcile a report, open a ticket, summarize a mailbox. The useful ones are scoped narrowly to a single job and connected to systems you already run.
Use a cloud API in your own account unless you have a reason not to. It is cheaper to start, easier to maintain, and gives you frontier models. Self-host when export control demands the data never leave your building, when you need an air gap, or when query volume is high enough that owned hardware pays for itself.
There are three parts: licenses or model usage, the build, and ongoing management. Managed accounts start at a per-seat monthly cost. A model deployment in your own cloud account is usage-based and often lower than per-seat pricing. Self-hosted hardware is a capital purchase. We scope a fixed quote after a discovery call.
Blocking alone fails, because people are using it for a reason. What works is giving them a sanctioned tool that is at least as good, then restricting the unsanctioned ones through DNS and endpoint policy, backing it with a written acceptable use policy, and monitoring for the tools you did not approve.
A deemed export is the release of controlled technical data to a foreign person, even inside the United States. For AI it means auditing the whole inference path, not just the model: the gateway, the logging, the vector store, temporary compute, and support staff. If a foreign national could reach any of those, the data may have been exported.
Only where a project requires it, and then on your equipment rather than ours. Every Tek Tools engineer is a US person working in the United States, so there is no deemed export to license. We would work from client-provided laptops over your VPN, so controlled technical data stays in your environment and never lands on our infrastructure.
Tek Tools provides AI consulting and AI agent development in Costa Mesa, Irvine, Newport Beach, Huntington Beach, Fountain Valley, and throughout Orange County. Our AI implementation services include Claude and AWS models deployed in Amazon Bedrock, private and self-hosted LLM deployment on your own hardware, managed Claude, OpenAI, and Google Gemini enterprise accounts, custom Model Context Protocol connectors, and secure AI integration with Microsoft 365, Google Workspace, and QuickBooks Online. We set up and manage enterprise AI accounts for businesses that simply do not want their proprietary data used to train another company's model, and we build compliant AI for defense contractors and aerospace manufacturers working under CMMC, NIST 800-171, ITAR, and EAR obligations, including deployments that keep Controlled Unclassified Information and export-controlled technical data inside your assessment boundary. Every Tek Tools engineer is a US person working in the United States, so no part of our support introduces a deemed export.