Briefing 01: Owning the Model, Owning the Data

Part 1 of 6 · The Technology Behind Better Outcomes — a technical briefing series from Quill Direct Vet Care.

Nearly every veterinary software vendor now claims to have AI. Almost all of them mean the same thing: a thin wrapper around a public model endpoint, with your clinical notes, your claim data, and your clients’ records leaving your control the moment a user presses Enter. Quill Direct Care made a deliberately harder engineering choice — we run the entire inference path inside our own cloud tenant, on infrastructure we provision, on networks that have no public ingress. This article explains exactly how that works, and why it is the difference between a demo and a system an insurer can underwrite against.

1. The problem with “we added AI”

The economics of the current AI market push vendors toward the fastest possible integration: sign up for a hosted API key, forward the user’s prompt, render the response. It ships in a week. It also means that a clinic’s differential diagnosis discussion, a pet owner’s financial hardship disclosure, and an insurer’s adjudication rationale all transit a third party’s multi-tenant infrastructure under whatever terms that third party publishes this quarter.

For a consumer productivity app that is an acceptable trade. For a platform that sits between a licensed veterinary practice, a regulated insurance carrier, and a pet owner’s payment instrument, it is not. Three constraints make it untenable:

• Data residency and control. Carriers conducting vendor due diligence ask where the data physically lives, who can read it, and what contractual right the vendor has to use it. “Our AI provider says they don’t train on it” is a weaker answer than “the inference endpoint is a private endpoint on our virtual network with no route to the public internet.”

• Auditability. When an AI-assisted recommendation influences a clinical or coverage decision, someone will eventually need to reconstruct what the model saw. That requires owning the prompt, the retrieved context, the model version, and the trace identifier — not just the answer.

• Continuity. A pricing change, a deprecation notice, or a rate limit at a third-party API becomes an outage in a system a clinic depends on to check in patients. Owning the deployment converts a vendor risk into a capacity-planning exercise.

The architectural thesis

Model weights are a commodity and will keep getting cheaper. What is not a commodity is a production-grade, network-isolated, identity-governed, fully instrumented inference path wired into a real transactional system of record. That is what Quill built, and it is what takes eighteen months rather than eighteen days to replicate.

2. The Quill AI stack, end to end

Every AI feature in the Quill portal — the clinical scribe, the vet chat, symptom triage, coverage validation, fraud explanation, population health analysis — resolves through a single governed path. There is exactly one way for a request to reach a model, and it is instrumented.

2.1 Tenant-owned model deployments

Quill provisions its own Azure OpenAI resource inside its own subscription and deploys named models into it — currently a reasoning-tier model, a cost-optimized model for high-volume calls, an embedding model, and a speech-to-text model. These are Quill’s deployments, addressed by Quill’s endpoint, secured by Quill’s keys and managed identity. Microsoft’s published commitment for this service is unambiguous: customer prompts, completions, and embeddings are not used to train, retrain, or improve any foundation model, and are not shared with other customers.

That commitment matters, but Quill does not rely on it alone. The endpoint is reachable only from the platform’s virtual network, authenticated by workload identity rather than a shared secret in application code, and every call is attributed to a request trace before it is issued.

2.2 The gateway abstraction

A single shared client module mediates every model call in the platform. It resolves the active gateway, normalizes model identifiers across providers, and gives Quill a switch it can throw without touching feature code:

• One code path. Chat completions, embeddings, and audio transcription all route through the same authenticated helper. There is no second, undocumented way for a feature to call a model.

• Model portability. Feature code requests a capability tier, not a vendor SKU. The gateway maps that tier onto whatever deployment is currently configured, so upgrading the reasoning model across thirteen backend functions is an environment-variable change, not a refactor.

• Deterministic failover. If the primary gateway is unconfigured or unreachable, the helper degrades to a defined secondary rather than failing silently or, worse, leaking traffic to an unmanaged endpoint.

• Cost and latency attribution. Because all traffic funnels through one place, per-feature spend and per-feature p95 latency are measurable rather than estimated.

2.3 Grounded retrieval, not open-ended generation

Quill’s clinical AI does not answer from model memory. It answers from a retrieval index and cites what it used — a design that follows directly from the retrieval-augmented generation literature, which established that grounding generation in retrieved passages produces more specific and more factual output than a parametric model alone.

The behavioral consequence is visible in production. When the index does not contain material that supports an answer, the system refuses and says so, rather than producing a plausible paragraph. In validation testing against a near-empty index, a request for a canine vaccination schedule returned a refusal and an empty citation array — exactly the intended failure mode. A veterinary AI that confidently invents a dosing interval is not a feature; it is a liability. Article 02 in this series details the retrieval architecture.

3. Governance is the product

The security posture around the AI stack is not a compliance afterthought bolted on before a sales cycle. It is the reason the stack can be sold into regulated buyers at all.

A note on regulatory framing

Quill states this precisely, because precision is itself a due-diligence signal: HIPAA governs human protected health information and does not, as a matter of law, apply to veterinary records. Quill nevertheless engineers to HIPAA-equivalent technical safeguards and maps its control design to the SOC 2 Trust Services Criteria. The reason is practical — the carriers and enterprise clinic groups Quill integrates with run vendor security reviews written for healthcare, and the pet owner data flowing through the platform (identity, payment instruments, financial hardship, household detail) deserves that standard regardless of what the statute compels.

4. What this unlocks for each constituency

For insurers

• A vendor whose AI data flow can be diagrammed, evidenced, and contractually bounded — which shortens security review from a blocker to a checklist.

• Model-assisted adjudication support where every recommendation carries a trace identifier, the retrieved sources, and the prompt version that produced it.

• No exposure to a downstream AI provider’s terms changing mid-contract, because the deployment is Quill’s.

For clinics

• Clinical notes dictated into the scribe are transcribed by a model deployment inside the platform boundary, not uploaded to a consumer transcription service.

• Answers cite sources, so a veterinarian can verify in seconds rather than trusting a paragraph.

• Performance and availability are Quill’s operational responsibility, with capacity provisioned against real clinic traffic patterns.

For pet owners

• Conversations about a pet’s health and a household’s ability to pay for it are handled as sensitive records, not as training data.

• Guidance is grounded and cited, and the system says “I don’t know” rather than guessing about an animal’s health.

5. Why this is defensible

Competitors can license the same models tomorrow — that was always true and it is not where the advantage sits. The advantage sits in everything wrapped around the model call: private networking with working private DNS resolution, a hardened secret store, deterministic egress that partners have already allow-listed, workload identity across CI and runtime, a retrieval index with an enforced schema contract, citation guardrails validated against real refusal cases, and thirteen production features already migrated onto the shared gateway.

Each of those is individually unremarkable. Assembled, operated, and evidenced together — in a domain where the buyer is an insurance carrier’s security team — they constitute a barrier that a feature-level competitor cannot clear by adding a chat box.

Evidence base

The following peer-reviewed findings were verified against primary sources; full citations appear in the References section.

Ungrounded models fabricate citations at material rates. Across 1,800 references generated from 120 clinical anatomy questions, measured reference-hallucination rates were 23.2% for one frontier model and 45.8% and 47.5% for two others — the failure mode a citation-required architecture is designed to eliminate. (Ülkir & Paslı, Clinical Anatomy, 2026)