Straight answers to the questions security review asks first.
The questions we hear most from data leaders, security and privacy reviewers, procurement, and the engineers who will live with the result. If yours isn't here, write to hello@bennerhouse.com and we'll answer it directly.

Working with us
What kinds of organizations do you work with?
Mid-market and regional enterprises, such as health systems, insurers, banks, law firms, logistics and manufacturing operators, and utilities, plus AI product companies building models for a specific industry. What they share is valuable records that weren't written with a model in mind. See industries.
What does a first engagement usually look like?
Either a three-week AI Data Readiness Assessment, when you have several ideas and need to know which your data can support, or a fixed-scope pilot on one use case you've already chosen. Both have published starting prices.
How long do projects take?
An assessment takes three weeks. Most pilots run three to six weeks; a fine-tuning dataset sprint is four. Production timelines follow volume and are set in the written scope. Managed Data Operations runs monthly with no end date.
Do you work on-site?
When it's needed. By default we work remotely through access you grant inside your own cloud or network. When records can only be read on your premises, our team works on-site, in Jackson or at your location, on workstations you provide.
Who will we work with day to day?
One engagement lead who owns scope, schedule, and a weekly written report, plus the data engineers, annotation lead, privacy reviewer, and domain experts the project needs. You meet them by name before any data moves. See how the team is built.
Data, security and privacy
Does our data leave our environment?
No. We work through a read-only service account in your cloud, a virtual desktop you control, or a workstation on your premises, and deliverables are written to storage you own. Our working notes contain counts, scores, and short redacted excerpts, never bulk copies. Details are on our security page.
Who can see our records?
Only the people assigned to your project, all of them US persons employed by Benner House, background-checked, and bound by a confidentiality agreement. Access is granted per person, limited to what the task needs, and removed when their part of the work ends.
Will you sign a business associate agreement?
Yes. BAAs are available for any project involving protected health information, and we sign data processing agreements for other personal data. Benner House is not a law firm and does not provide legal advice; your counsel decides what your data requires.
What happens to our data when the project ends?
Everything we produced stays with you, versioned. Any client data in our working environment is deleted within 30 days of project close, and you receive a written deletion record listing what was removed and when.
Do you use our data to train your own models or to help other clients?
No. Your data is used only for your project. We don't train models of our own on client data, and nothing from one client's records is reused for another.
How would we hear about a security incident?
Our contracts commit us to notify you within 72 hours of discovering a security incident affecting your data, with what we know, what we've contained, and what we're still investigating.
Pricing and contracts
Why do you publish prices?
So you can tell whether we fit your budget before spending time on a call. Each starting price comes with the scope it buys. See pricing for every starting price and what moves a quote.
How do you bill?
Fixed-fee assessments and pilots are invoiced 50% at kickoff and 50% on delivery. Expert judgments are invoiced monthly in arrears, only for judgments that passed our quality gates. Managed Data Operations is invoiced monthly in arrears. Invoices are due within 30 days.
Who owns what you produce?
You do. Datasets, labels, guidelines, rubrics, evaluation sets, reports, and code we write for your project are yours on payment. We keep only our general know-how and the tools we had before your project, and you receive a license to use any of those that are built into your deliverables.
Can we use our own contract templates?
Usually, yes. We regularly review client master agreements, NDAs, BAAs, and security addenda. If you'd rather use ours, we'll send them after the scoping call.
Do you charge for the scoping call or the written scope?
No. The 30-minute call and the written scope that follows are free, and neither requires you to share data.
Quality and evaluation
How do you measure label quality?
Three ways, on every batch. Agreement between independent annotators must reach a Krippendorff's alpha of at least 0.80 on categorical labels. Each reviewer must stay at 95% or better on hidden gold questions. And at least 10% of every batch gets a second reviewer. The full method is on our approach page.
Why do you insist on an evaluation set?
Because without one, nobody can tell whether a new dataset helped. Every delivery ships with a before-and-after measured against a held-out set your experts agreed on. We explain how to build one in Fifty right examples, and we build them as a service in Evaluation, Benchmarks & Red-Teaming.
What if training on the data doesn't improve the model?
Then we report that plainly, with the measurements, and recommend what to change or whether to stop. A pilot that shows an approach won't work has saved you the cost of a production run.
Who are your experts?
Practicing and recently practicing professionals, including clinicians, coders, adjusters, underwriters, attorneys, paralegals, engineers, and field technicians, employed part time and verified before they see a record. See the expert network.
Do you use AI models to label data?
Yes, for pre-labeling and as judges, but never unchecked. A judge model is calibrated against your experts' scores on the same items before its numbers are trusted, and every model-assisted label is marked as such in the provenance manifest. See Calibrating LLM-as-a-judge.
Technical
What formats do you deliver in?
Usually JSONL or Parquet for records, CSV for registers, and Croissant metadata plus a written datasheet for each dataset, all versioned. We match your training stack's format if it needs something else. See the sample datasheet.
Which clouds and tools do you work with?
AWS, Azure, Google Cloud, and on-premises clusters, using Spark, Ray, and the storage, vector databases, and orchestration you already run. We recommend no platform by default. See Computational Data Processing.
Can you handle scanned documents, faxes, and handwriting?
Yes. We pair OCR with layout analysis so tables, checkboxes, and multi-column pages keep their structure, measure read quality on a sample, and route low-confidence pages to human review. See Document AI & RAG Data Pipelines.
Do you build RAG applications or just the data?
The data layer: parsing, chunking, metadata, embeddings, the index, and a retrieval test set with measured recall. Your application team or vendor builds the interface on top, and we can work alongside them.
Can you help us train or test AI agents?
Yes. We record expert trajectories of real workflows and rebuild those workflows as sandboxes with tools, seeded data, and automatic verifiers. See Agent Trajectories & RL Environments.
Keep reading
Bring us one messy data source and one question.
Tell us what the data is and what you want a model to do with it. A data engineer, not a salesperson, will reply within one business day with questions and a proposed first step.