The data sat in a shared folder. For most industries that is a compliance problem. For this one, it is a person’s safety.
Atlas is the firm’s secure institutional data environment — the governed home for the linguistic, cultural, and engagement data the Human Intelligence Collective, the AI Data Factory, and the Cultural Compliance Bureau produce. Built on a compliance-capable Microsoft foundation, with consent, provenance, and jurisdiction enforced as infrastructure rather than entrusted to policy.
The default tooling treats data as files: a shared drive, a folder, a handful of spreadsheets emailed between people who mean well. The data is there, and on a good day it is even backed up. What is not there is everything that was supposed to travel with it. The consent that made a recording lawful sits in a different system, if it was kept at all. The provenance that tells you which dialect band a transcript represents, who validated it, and against which guideline version, was never attached. The residency rules a European client is bound by are honored by accident or not at all. And access is whoever has the link.
For most industries this is a compliance exposure — real, but bounded by fines and remediation. For this firm’s work it is something else, because the data concerns people with genuine security considerations: contributors with family still in Afghanistan, populations a hostile actor would be glad to enumerate. Here, separated consent and unbounded access are not a paperwork failure. They are a safety failure, and the person who pays for it is not the institution.
So the firm does not store this data in folders. It holds it in a governed environment where the obligations are part of the infrastructure: provenance and consent bound to the record, access bounded by role, residency specified by jurisdiction, and a population-risk gate standing over what enters and what leaves. Storage is the easy part. Atlas exists for the rest.
Anything can store a file. Stewardship is the obligations the file carries — consent, provenance, residency, population risk — enforced by the environment, not entrusted to good intentions.
Encryption protects data from interception. It does nothing about the question that matters most for this population: where the data resides, and who can compel its disclosure. That is a question of structure, and the firm answered it structurally.
Jurisdiction is a legal control, not a technical one. The absence of a compellable in-country entity removes the local legal nexus an Afghan compulsion order would require — it is not a substitute for encryption, access control, and key management, and it does not displace the firm’s obligations under the laws of the jurisdictions in which it does operate. Residency tells you where data sits; jurisdiction tells you whose law governs it — and the firm treats jurisdiction, not storage location alone, as the controlling factor.
For the institution entrusting work to the firm, Atlas changes the answer to the diligence questions that decide vendor selection. Where will our data live, and under whose jurisdiction — answered specifically, to your terms, not waved away. Who can access it — answered with role-based, logged access rather than a shared link. How do we know an asset’s origin and consent — answered by provenance that travels with the record. And what about the population this concerns — answered by a structure that keeps the most sensitive data out of the country it came from, off the public site, and behind a population-risk gate. The data your vendor-risk team worries about most is the data this environment was built to hold.
The obligations Atlas enforces are owed by named individuals who answer for them. The firm’s stewardship of this data is human before it is technical — these are the people accountable for what the environment holds, and for what it will never do with it.
For institutions whose Afghan-language data is too sensitive for a shared drive and too consequential for a vendor who cannot say where it lives. Briefings are conducted under NDA, in Washington, D.C. or virtually.
Request a confidential briefing