Security & Trust

Responsible by design

The communities you serve deserve AI built with the same care and conviction your staff brings to their work every day. That starts with how we handle your data, protect your environment, and earn your trust.
SOC 2 Type II
View report
GovAI Coalition
Founding member
Microsoft Azure
Enterprise cloud partner
Dedicated isolation
Per-customer environments

Infrastructure

Built on Azure. Isolated by design.

Madison AI runs entirely on Microsoft Azure with dedicated resources per agency. Your environment is completely separate from every other customer — not shared, not pooled, not co-mingled. This isn't a premium tier. It's how every deployment works.

Dedicated per customer

Every agency gets its own isolated environment — separate data stores, separate search indexes, separate processing. No shared infrastructure between clients.

U.S. Azure regions only

All storage, search, and AI processing happens within U.S.-based Microsoft Azure commercial cloud regions. No offshore processing. No third-party routing.

Your identity, your policies

Staff authenticate through your existing Microsoft Entra ID. Your MFA, conditional access, and role-based policies carry right into Madison. No separate logins.

What happens to your data.

Every piece of data that enters Madison — your documents, your staff's queries, your AI outputs — is protected at every stage. Here's exactly how.

OUR PROMISE

PII scrubbed on entry

Data enters through secure, authenticated channels only — SharePoint connectors, secure file transfer, or direct uploads. We scrub for personally identifiable information on the way in and monitor for it in everything your team uploads.

Enterprise AI models only

We run AI exclusively through Microsoft Azure's enterprise services. Your data never touches a consumer endpoint, never trains a model, and is never stored or retained by the model provider.

Separated and cited

Your staff needs agency data, their own work product, and sometimes the broader web. We keep those layers clearly separated — and every answer tells you exactly where it came from.

You own it. We never will.

We're a service provider, not a data company. We don't sell, share, or monetize your information. If you ever leave, we securely delete everything and confirm it in writing.

Observability

You see everything. We hide nothing.

Every interaction, every output, every piece of feedback — logged, traceable, and available when you need it.

Every answer is traceable

Madison grounds responses in your documents and cites the sources. Nothing is pulled from general internet knowledge. Your team can verify any answer against the original record.

Full audit trail

Every chat and response is saved — for compliance, FOIA, or internal review. You set the retention policy. If you need to pull something up later, it's there.

AI assists, humans decide

Madison doesn't publish, execute, or enforce anything on its own. A staff member always reviews before an output goes anywhere. By design, not by limitation.

Real people review every piece of feedback.

When your staff hits thumbs down, that feedback doesn't disappear into an algorithm. A member of our team reads it, diagnoses the issue, and makes a targeted improvement to your model. It's how your AI gets smarter every week — and it's why our customers trust what Madison gives them.

Compliance

The bar is high. We get it.

You need infrastructure you can defend in a council meeting, justify to an auditor, and trust with decades of institutional knowledge.

SOC 2 Type II

Completed

HIPAA eligible

Azure HIPAA-eligible services

NIST 800-53

Aligned, selected controls

FedRAMP Moderate

Inherited via Microsoft Azure

Questions we hear in every evaluation.

Does our data train AI models?

No. Your data is never used to train, fine-tune, or improve any AI model — not by Madison, not by Microsoft, not by anyone. This is enforced at the infrastructure level through our Microsoft Azure enterprise agreement, not just a policy promise.

What happens to our data if we leave?

All of your data — documents, interactions, outputs — is securely deleted from your dedicated environment. Before deletion, you have the opportunity to export everything. We provide written confirmation once the process is complete.

Who at Madison can access our data?

No one on our team accesses your environment without your explicit written approval. When access is needed for a support issue, it's time-limited, logged, and revoked immediately after. Your data is your data — we don't browse it.

How do we know the AI's answers are accurate?

Every response cites its source documents so your staff can verify before they act. When someone flags an inaccurate answer, a real member of our team reviews the feedback and makes a targeted improvement. No automated black box — real people making your AI better every week.

See what responsible AI looks like in practice.

We're happy to walk through our architecture with your IT team, answer a security questionnaire, or connect you with a customer who's already been through the evaluation.

Used and trusted by 60+ local governments and counting