Privacy-first AI QA is an architecture decision before it is a policy.

A policy can say that drafts are confidential. It cannot make a copied draft confidential once it is in another company's storage layer, under another company's retention defaults, subject to another company's incident history.

So the useful question is structural: what has to exist for the check to be performed? If the answer is a rule engine that runs locally, then the material never becomes a second record, and most of the compliance conversation disappears with it.

That is what privacy-first means here. Not a toggle, not a redaction filter applied after upload, but a design in which the upload step is absent.

Ask these before the pilot, not after the renewal. A vague answer to any of them is itself an answer.

Minimisation is not an engineering feature. It is a habit that decides how much material enters the process in the first place: paste the section that needs checking rather than the whole repository, drop the customer names before you paste an example table, and keep the client's file in the client's own system.

That habit survives tool changes. A team that pastes only what it needs is protected whether the checker is local or not, and it produces better reports because the findings map onto a readable input.

The complement is escaping hatch design: the tool should make it obvious when something leaves the browser. A button labelled attach to a review should be the only one that transmits a file, and the confirmation should say where the file is going.

A stored verification report holds the findings, the metrics, the score, a title and a short excerpt of the submitted work. It is enough to recognise the piece later and to argue about the result, and it is not the piece itself.

That distinction matters for two reasons. A report you can attach to a delivery is an asset; a stored library of client drafts is a liability. Keeping the first without the second is the point of the excerpt field.

The report is also scoped to you by access rules, so a colleague cannot browse your checks unless your organisation arranges otherwise.

There is a real tension here. A process with no records is private and unprovable, and a process with complete records is provable and exposed.

The resolution is to decide what the record needs to prove, then keep only that. If the claim is this deliverable passed a gate on this date with these findings, the findings and the date are enough. If the claim is the reviewer read the whole document, then a human sign-off with a scope description is the right artefact.

What is rarely needed is the raw draft, retained for a year, available to anyone with an admin role.

A named reviewer must see the work. Sending it to them is a disclosure, and pretending otherwise helps nobody, least of all the client who assumed otherwise.

The mitigations are ordinary ones: agree the scope before the file moves, send a link rather than a copy where you control access, name the reviewer in the request so the recipient list is not an anonymous pool, and say in the engagement what the reviewer may keep afterwards.

On this platform a review request records the requester, the brief and the reference, and a reviewer is a listed practitioner with a rate and a turnaround, not an inbox that swallows documents.

Most policies fail because they ask staff to make a security decision in the middle of a deadline. Better to name categories: public copy may be checked anywhere; internal drafts may be checked with local tools; client material and personal data require the local path or a documented exception.

Then name the artefacts. Every gate produces a report; escalations produce a signed verdict; both travel with the deliverable, and neither includes the raw source unless somebody chose to attach it.

That is a short paragraph, and it is enforceable, which is more than can be said for a policy that says be careful with AI tools.

The usual answer to a privacy problem is to remove the sensitive parts and send the rest. It is a reasonable instinct and a poor control, because redaction is partial by nature: a name becomes a placeholder and the address, the unusual case detail and the identifying combination stay behind.

It also damages the report. Replace every date and figure with a placeholder and the checks that look for unsourced statistics and mixed date formats have nothing to measure. You end up with a clean-looking result produced by removing the evidence, which is worse than no result because it is reassuring.

Local processing makes the trade unnecessary. There is no need to strip the paragraph that makes the check useful, because the paragraph never leaves. That is a genuine argument for the architecture rather than a slogan about caring about privacy.

Where redaction is still the right move is in the human step, and there it should be deliberate: send the extract the reviewer needs, not the whole folder, and say what was withheld so their verdict can account for it.