Claremont SecurityManaged compliance · Enterprise AI protection
Microsoft 365 Copilot, managed for regulated firms

Your staff already use AI.

We settle the control question first.

We set up Copilot in the Microsoft 365 your firm already pays for. Before anyone uses it, we fix who can open which files. You get a dated record of every safeguard.

Start the conversationFees and engagements
Fixed feesRead-only assessmentNothing switched on before the permission review
One client file, two routesLive · each gate is an obligation
Attaches, no record Conditional Mapped, dated
A · personal AI accountNothing stops the file going here. Every obligation still attaches, and the firm has no record that any of them was met.
B · governed Microsoft 365 tenantThe same file inside the tenant the firm already pays for. Each obligation mapped to a control, and each control dated.
16 CFR 314 · 26 U.S.C. §7216Open the instrument
16 CFR 314.4(j) · 30 days to notify the FTC of a notification event of 500 or more consumers16 CFR 314.6 · below 5,000 consumers, 314.4(b)(1), (d)(2), (h) and (i) do not apply; every other paragraph does16 CFR 314.2(m) · encrypted customer information with the key intact is not a notification event16 CFR 314.4(c)(5) · multi-factor authentication for any individual accessing any information system, unless an equivalent control is approved in writing16 CFR 314.4(c)(6) · secure disposal within two years of last use, unless a named exception applies16 CFR 314.4(f) · service providers bound by contract to maintain safeguards, and reassessed26 U.S.C. §6713 · $250 per disclosure of return information, $10,000 per calendar year26 CFR §301.7216-2(d)(1), (d)(3) · return information goes without consent only to a preparer located in the United States; a contractor’s employee abroad who only views it puts the disclosure outside the United States
01

Who we work with

Firms that hold information other people trusted them with. The controls are the same in every one. The rules differ, and each engagement is mapped to the ones that apply.

Firm
What governs the data
What it looks like with AI
Accounting and tax firms
FTC Safeguards Rule · 26 U.S.C. §7216
A preparer checks a schedule by pasting the return into a chatbot. Return information is covered by a federal statute with criminal penalties attached.
Wealth managers and financial advisors
SEC Regulation S-P · FTC Safeguards Rule
A client review drafted from account statements in a personal AI account. SEC-registered advisers must now keep a written incident response program and notify affected clients within 30 days.
Law firms
Model Rule 1.6 · ABA Formal Opinion 512
Matter details summarized in a consumer tool. The ABA has addressed when client consent is needed before that happens.
Mortgage brokers and lenders
FTC Safeguards Rule
Every loan file holds returns, bank statements and Social Security numbers, and closing funds are what wire fraud targets.
Medical, dental and therapy practices
HIPAA Security Rule, 45 CFR Part 164
Visit or session notes drafted in an AI tool nobody approved. A documented risk analysis is the first thing a regulator asks for.

The Safeguards Rule also reaches collection agencies, finance companies, credit counselors and dealerships that arrange financing. The same engagement applies.

How each engagement is mapped →
02

The chain we work along

Every engagement follows the same sequential order.

Statute

The rule that binds the firm, read against its primary source.

Obligation

The single "you must" inside it, in plain English, with the threshold that switches it on or off.

Control

What the firm actually does about it, delivered inside the Microsoft 365 tenant it already pays for.

Evidence

The artifact that proves the control ran, with the date it was observed and the window before it goes stale.

Answer

What a partner hands to the person asking. Never a certificate. A dated record of what was in force.

03

What a deployment leaves behind

Two agents every firm gets, and one built for the work your practice does. Each hands back a draft for a person to check. None of them sends anything.

Firm Assistant

Copilot · the whole firm · every day
What it hands back
A draft in your firm’s own voice, with every date, dollar amount and client name in bold and its sources listed. It hands the decision back to you and never sends anything.

Morning Brief

Copilot · anyone with an inbox · before the first call
What it hands back
Your overnight inbox, sorted into reply today, chase and file, with the chases already drafted and the most important items at the top. A person reads it, adjusts it and sends it.

Return Reviewer

Copilot · tax staff · reads the client files only
What it hands back
Checks a draft return against its K-1s, box by box, ranks every difference by size, and drafts the letter asking the client for what is missing. It never says what a number means; the CPA does. The firm uses it only on returns whose clients have consented, and keeps Social Security numbers out.

Clean Room

Free · in the browser · for anything leaving the tenant
What it hands back
The same text with the client identifiers swapped for reversible tokens, so a document can go to a tool the firm does not control and come back whole. Nothing is uploaded.
Open the Clean Room →
04

Advisory, oversight and compliance

Three ways we work. Every one priced in writing before it starts.

I

Secure AI Integration

Copilot set up in the Microsoft 365 you already pay for, with file access fixed first.

What you get
  • File access review
  • Data loss warnings for staff
  • Two firm-wide agents and one practice agent
  • Staff training
  • Usage logging and an AI statement for your clients
  • A dated handover report
Time and fee

A few weeks, done remotely
Fixed fee

II

AI Oversight and vCISO

A named advisor who answers for your security settings in writing and keeps the AI environment growing. You keep your IT provider.

What you get
  • New agents reach your tenant in the quarter they ship
  • New gallery prompts and notes on what Microsoft changed, as they are written
  • Sign-in and access controls, and device and update checks
  • Client and insurer questionnaires answered, with the evidence
  • A quarterly review with your leadership
Time and fee

Ongoing
Monthly retainer, cancellable at renewal

What this does not cover →
III

Compliance Documentation

The written security program a regulator expects, written for your firm, with the gaps named.

What you get
  • Written Information Security Program
  • Incident response plan and a practice run
  • Vendor register
  • AI use policy
  • Staff training with completion records
Time and fee

Three weeks
Fixed fee

Not sure where to start? Begin with the Baseline Security Assessment: two weeks, read-only, nothing changed. You get a written list of gaps, each with a recommended owner and a target date. The fee is credited in full against the engagement that follows, if it starts within 90 days.

Engagements and feesTalk to us
05

Elsewhere on the site