Trust is architecture, not policy.

Where Padanet runs, and who operates what. One shape is deployed; the rest are specified and are not.

• Padanet-hosted — managed by us, in Europe. This is what runs today, and what a design partner gets.
• Private cloud, single tenant — your cloud, your control, our software. Designed; the operational responsibility moves to you.
• On-premise — fully isolated, for regulated estates, usually with a private exchange node. Designed.
• Hybrid — organizational nodes in your infrastructure, personal memory private, exchange nodes mediating. Designed, and the shape we expect most large estates to want.

Tenant data lives in a private realm and is not pooled. Two things are shared on purpose, and saying so is the point of this block.

• Your memory and your agents run on per-tenant nodes in a private realm — the placement rule for anything tenant-owned.
• Each person's own signals sit in their own encrypted channel, designed so that neither their manager, nor their IT, nor Padanet reads them.
• Shared on purpose #1: an exchange node in the shared realm, which is how a tenant shares what it chooses to share. Nothing reaches it that the tenant has not released.
• Shared on purpose #2: model inference may run on a shared pool, for cost. It is stateless — no conversation storage, no fine-tuning side effect, nothing a later request depends on — and a tenant that wants inference private can have it.

Connectors read in. The context packet goes out under a declared purpose. The raw signal stays where it was collected.

• Connectors read from the systems you already own, read-only and purpose-bound. Metadata first: no keystroke capture, no screen capture, no message content.
• What leaves the memory is a context packet — the smallest adequate, authorized, current, evidence-backed set of claims for one declared purpose — not the signals it was distilled from.
• Purpose is enforced at the moment of access rather than audited afterwards: a claim usable for staffing is not usable for a performance review.
• Model calls carry the packet, not the corpus, and are stateless by design.

How an individual signal becomes an organizational answer without becoming a readout about a person. Specified, and not something you can inspect on a deployment today.

• Leader-facing views are aggregated, with a floor below which a cohort is not reported at all.
• Individual data never becomes an organizational readout: the consented lens is the person's, and what a leader sees is the aggregate.
• Where a self-view is exposed, the person sees it first and can correct it.
• This is the part of the architecture a security review should press hardest on, and the part we most want proved on a real estate rather than asserted here.