The system of record for how a family office works in the AI era.
Trustward governs every use of AI in the office and keeps what the office knows. The office's own policy decides where each piece of work goes: sensitive information stays in-house, routine work runs locally, and only what needs a frontier model leaves, without what the family protects.
Status · Built and running · In private demonstration
- Found
- Family member · Trust · Account number
- Policy
- Family members and trusts stay in-house
- Route
- SovereignThe office's own model
- Left the office
- Nothing
The problem
AI arrived in the office before anyone decided it should.
Staff already use it, often on personal accounts, for the office's everyday work: the bank statement to reconcile, the letter to the trustees, the status report on the principal's personal project. Whatever they paste in leaves the office.
What left the office
Today
Nobody can say which names, numbers or documents went to which outside service.
With Trustward
The office's policy decides what may leave, and the record shows what did.
How it worksWhat it costs
Today
Nobody can say that either. Subscriptions sit on personal cards, and the same expensive model does the simple work and the hard.
With Trustward
Routine work runs locally. Frontier spend has limits, and every reply carries its cost.
Where work goesWhat leaves with people
Today
Everything they knew: how the statements are reconciled, who to call at the bank, why a decision was taken. Little of it is written down, and their AI work sits in chat histories the office never sees.
With Trustward
What they knew stays in the office's memory, and whoever follows them can ask it.
The office's memory
Most AI tools ask a family office to choose between adoption and control. Trustward removes the choice.
How it works
Governance starts with the office's own policy. From then on every message is read against it, routed by it and recorded, cost included.
The office's policy, written with the office
Trustward reads how the office already works, from its systems and documents to its correspondence, and drafts its AI policy with the principal and the COO: what is sensitive, who may see what, what may leave and what the office will spend.
AI policyThe Renwick office · approved by the principalWhat What happens Family members and their children Keep in-house Trusts, companies and foundations Keep in-house Health, divorce and inheritance Keep in-house Live deals Keep in-house Account, identity and property details Replace before it leaves Routine drafting and summaries Local model The frontier model Named staff, monthly limit Every message is read against it
Before anything is sent, Trustward reads the message and the conversation behind it for what the policy protects: names, entities, properties, accounts, identity documents, health, legal matters and live deals.
Found · Family member · Trust · Account number
The policy decides where it goes
Sensitive work stays on a model the office controls. Routine work runs locally too, at almost no cost. Only work that needs a frontier model leaves the office, and what the policy protects is replaced before it goes. Staff can choose only where the policy allows it.
The office's policyevery message is read against itSovereignSensitive work
Kept in-house, on a model the office controls.
SovereignRoutine work
Run locally too, at almost no cost.
AdvancedWork that needs more
A frontier model, with what the policy protects replaced first.
One record, whatever the routeroute · reason · costEverything on the record, cost included
Every message keeps its route, the reason the policy gave, what was found and replaced, the model that answered and what it cost. The COO reads it in the activity log; the spend is there by person, task and route.
Recordmsg_8f2c4d9e1b7a- Route
- Sovereign · the office's own model
- Reason
- Policy: family members and trusts stay in-house
- Found
- Family member · Trust · Account number
- Left the office
- Nothing
- Cost
- Local model · no charge per message
- Kept
- 2026-09-11 14:32:07 · A. Renwick
The office's memory
What the office knows stays with the office.
The office's own documents (procedures, policies, board papers, the family constitution) and the work done in Trustward become a knowledge base staff can ask. Answers quote their sources. When someone leaves, what they knew is already written down, and whoever follows them can ask it.
- Ask the office
- Plain questions, answered from the office's own documents, each answer with its source.
- Decisions and their reasons
- What was decided, by whom and why, kept where the next question will find it.
- Handover
- When someone leaves or joins, what they owned, decided and knew is already written down.
- Under the same policy
- Sensitive material stays in-house, and people can ask only about what they are allowed to see.
- Answer
- On the third working day, match each line of the statement to the trust ledger in the reconciliation workbook. Send anything unmatched to the COO by the fifth; items over £5,000 go to the trustees.
- Sources
- Monthly reconciliation procedure, v3 · Handover note from M. Clarke, June 2026
- Route
- SovereignThe office's own model
- Left the office
- Nothing
Use cases
What it looks like on a working day
Six moments from a single-family office, each with the record Trustward keeps of it.
Analyst · month end
Reconciling the Jersey trust's bank statement
The statement goes in as it is. The account numbers and the trust's name are found, the policy keeps the work on the office's own model, and the unmatched lines come back ready for the COO.
Sovereign · 3 found · nothing left the office
Office manager · a letter to the trustees
A careful letter that needs the best model
The draft goes to a frontier model because the policy allows it for this task. The family's names and the trust leave as stand-ins, and the letter comes back with them restored.
Advanced · 4 replaced · names kept in-house
Executive assistant · personal project
The weekly status report on the house build
Contractor notes and invoices are summarised on the office's own model. The address never leaves, and the work costs nothing per message.
Sovereign · routine · no charge per message
COO · Monday morning
The five-minute review
Last week in one log: what was flagged, what left the office and why, and what it cost by person, task and route.
Activity log · 9 flagged · cost by person
New analyst · first week
“How do we do a capital call?”
The answer comes from the office's own procedure and the handover note of the person who did it before, with both sources named.
Office's memory · 2 sources · kept in-house
Principal · before go-live
Deciding what the office's AI may do
The policy Trustward drafted from the office's own setup: what stays in-house, who may use the frontier model and the monthly limit. Approved once, applied to every message after.
Policy approved · applies to every message
What it governs
Governed. Preserved. Sovereign.
Governance, and everything it covers: the policy, sensitive information, where the work goes, who sees what, the record, the office's memory and the cost.
Governed
The office's policy decides what happens to every piece of AI work.
- The office's AI policy, drafted from its own setup and approved by the principal
- Every message read for what the policy protects
- Routed by the policy: local by default, frontier by exception
- Spending limits for each person and for the office, and simple work kept off frontier prices
Preserved
What the office does and knows is kept, whoever did it and whenever they leave.
- Every message kept with its route, its reason, the model and the cost
- Nothing in the record can be edited or deleted, by staff or by admins
- The office's documents and decisions, answerable with their sources
- When someone leaves, what they knew stays with the office
Sovereign
What the family protects does not leave the office.
- Sensitive work done on a model the office controls
- What goes to a frontier model leaves without the names and numbers
- The record held in the EU
- Access by invitation only: nobody signs themselves up
Running today
Built and in private demonstration
The demonstration runs at app.trustward.co.uk on made-up data. This is what it does now, and how it looks on screen.
- Two routes on every message, an open-weight model and a frontier model, with the route on the record
- Account numbers, identity numbers and family office subjects flagged on every message
- Account, routing, passport and card numbers and dates of birth replaced before anything reaches the frontier model, and restored in the reply
- Every reply recorded with the model that answered and the tokens it used
- Spending caps for each person and a daily cap for the whole office
- A record nobody can edit or delete, and an activity log by person, route, flag and date
- Staff and admin roles, access by invitation only, and the record held in the EU
Advanced · Logged 10:14:52 · Flagged · account-number · 1 replaced
4421-7732-1190 left the office as [Account number 1]
Summarise the 2025 LP letter and flag anything inconsistent with the investment policy
Draft a two-line note to the trustees confirming the transfer from account 4421-7732-1190
Beneficiary distribution schedule for the 2027 review
Draft a note to the trustees on the Jersey structure review
What we hold to
Built on four principles
The policy decides, not habit.
The office sets its rules once, with Trustward. Staff can still choose where the policy allows it, but the defaults are the office's, not whichever tool was open.
Local by default, frontier by exception.
Most of an office's AI work is routine and can run on a model it controls, at almost no cost. The frontier model is kept for the work that needs it.
Replace, don't block.
What the policy protects is removed before anything leaves, so staff keep working. The record keeps what was typed, what left and what came back.
Visible, not policed.
The record is there so the office can trust its AI, not to catch the people using it. Staff see exactly what the COO sees.
Three audiences
For the principal.
The AI the office uses is the AI you can approve. Your policy decides what stays in-house and what may leave, and every conversation is recorded for the audit you have not yet asked for.
For the COO.
Every conversation is logged, every user visible, every flagged message surfaced. Auditing the office's AI use is a five-minute task, not a quarterly project.
For the next generation.
The office's institutional knowledge lives in the system, not in the heads of the people leaving. The transition survives them.
The result is the one thing no current vendor offers: AI the principal approves, the COO audits, and the next generation actually uses.
Request a demonstration
Leave an address. We reply from a named person, not a mailing list, to arrange a walkthrough of the working product.
Your request is recorded. We will reply from a named address.
Sign in
For those given a demo account. The demo takes made-up data only.
Trustward. Governed. Preserved. Sovereign.