Part one of a two-part series. As enterprise leaders warn publicly about proprietary data flowing into frontier AI models, Midas.CEO argues the businesses with the least protection are the ones whose licenses depend on it most.
-- A bookkeeper has a question about a client's return. A therapist wants help summarizing session notes. A solo attorney needs a first pass at a contract. Each has a tool that could answer in seconds. Each also has an obligation—not a preference, an obligation—that makes using it a decision with consequences.
Most use it. Few could tell you where the data went.
That gap is the subject of this article and the platform Buji Development Corporation built to address it. Midas is an AI business operating system for small and medium businesses, built for operators without technical teams. Its case starts with a problem now being described by companies several thousand times its size.
The complaint from the top of the market
In July 2026, Palantir chief executive Alex Karp told CNBC that the industry's important debate was moving away from which company builds the smartest model and toward who controls the data, infrastructure and intellectual property underneath it. He said enterprise executives had privately raised concerns about surrendering proprietary information and competitive advantage to outside AI providers, and argued that frontier labs had oversold systems that absorb business knowledge without returning measurable value. Palantir published a nine-point manifesto the same week urging companies to retain control of their technology stack.
He is not alone. In August 2026, investor and All-In host Chamath Palihapitiya argued that concerns over IP and alpha leakage would reshape how enterprises buy software, with companies moving toward independent third-party control layers. Marc Andreessen has framed the industry's outcome as genuinely undecided—that model companies could own everything, or that "the whole thing's going to get eaten by open source." At CES 2026, Nvidia chief executive Jensen Huang said roughly 80 percent of startups were already building on open models.
Read together, the argument is clear: the model layer is commoditizing, while the durable question is control.
The part nobody is discussing
Every remedy in that conversation is priced for the enterprise.
Palantir does not call on a four-person dental practice. Sovereign deployments and air-gapped infrastructure are not procurement options for a two-attorney firm or independent financial advisor. Yet many small businesses operate under statutory confidentiality obligations.
Those obligations are specific. HIPAA's de-identification standard at 45 C.F.R. §164.514 defines the legal boundary at which health information stops being regulated. The American Bar Association's Formal Opinion 512, issued in July 2024, identifies the unconsented input of client confidences into self-learning tools as a central hazard for lawyers using generative AI. Financial firms operate under safeguarding, supervision and vendor-risk duties, and regulators have signaled that pointing at the software is not a defense.
In February 2026, the U.S. District Court for the Southern District of New York ruled in United States v. Heppner that documents a criminal defendant had produced using a consumer AI chatbot were protected by neither attorney-client privilege nor the work product doctrine. The court held, among other things, that the platform's consumer privacy policy permitted collection of user inputs and outputs, use of that data for model training, and disclosure to third parties—so no reasonable expectation of confidentiality attached.
Midas is deliberate about the distinction. No software architecture creates attorney-client privilege; privilege requires a lawyer. What architecture can address is whether a reasonable expectation of confidentiality exists and whether an operator can demonstrate where data went and where it did not.
So the licensed professional is left with a question the enterprise now has vendors to answer and Main Street does not: can I use this without breaking the thing my license exists to protect?
"Every business owner using AI should be able to answer one simple question: where does my data actually go?" said Thomas McMurrain, chief executive of Midas.CEO. "For most tools, the honest answer is unsettling. For a doctor, a lawyer, or a financial advisor, that difference is their license."
What Midas has built, and what it has not
Midas's response is architectural rather than contractual, and the company distinguishes what is running today from what is still being deployed.
The platform operates in two modes and tells the operator which is active. Atlas is the frontier tier, used for public-facing work that benefits from broad general capability, and Midas labels it not private. The second mode runs on GPU hardware the company owns and operates in Atlanta. Requests in that mode are blocked from reaching external frontier models at the model call itself, and the block fails closed and is logged—a property the company describes as the difference between a routing preference and an architectural guarantee. Designated confidential data classes, including client records and communications archives, are blocked from frontier routing at the interface layer regardless of user consent.
The company's technical documentation states the reasoning plainly: a rule a hurried user can waive is a rule that will be waived.
Midas holds CASA Tier 2 certification—the Cloud Application Security Assessment, an OWASP-based framework used to evaluate application security controls—scoring 9.7 out of 10 on its first scan. The certification covers the platform's application security posture. The company is explicit that it is not a validation of any individual privacy claim. Its pseudonymization pipeline remains in deployment, with third-party audit and formal expert review required before its strongest public claims. MidasSecure will not be made available to clients before testing is complete.
That candor is a design position rather than a disclosure. Letting a customer assume a privacy they do not have is, in the company's framing, how trust ends.
Where the second article goes
The architecture above addresses where business data travels. It does not address what the model was taught before it met the business.
Models trained on the open internet inherit the internet's weighting—content ranked by volume and availability rather than accuracy or demonstrated competence. For a business asking a consequential question about compliance, operations, or a client, that is a structural defect, not a tuning problem.
Part two of this series will examine Midas's answer: MidasOne, a small language model for small and medium business, and the company's argument that the right teacher for business AI was never the internet.
Readers can review the platform at Midas.CEO, assess their position through the company's AI Readiness Survey, or read The Midas Report. Company updates are published on LinkedIn and X. Editorial inquiries: midas@agentmidas.xyz.
About Midas.CEO
Midas, developed by Buji Development Corporation, is an AI business operating system for small and medium businesses, particularly licensed professionals in medicine, law and finance. The platform combines two-mode architecture, company-owned GPU infrastructure, a curated knowledge repository, and a governance layer. Midas holds CASA Tier 2 certification. Founded and led by technologist Thomas McMurrain, the company is developing MidasOne, trained on verified business knowledge rather than scraped web data.
Contact Info:
Name: Thomas McMurrain
Email: Send Email
Organization: Midas.CEO
Website: https://www.midas.ceo/
Release ID: 89200937
If you come across any problems, discrepancies, or concerns related to the content contained within this press release that necessitate action or if a press release requires takedown, we strongly encourage you to reach out without delay by contacting error@releasecontact.com (it is important to note that this email is the authorized channel for such matters, sending multiple emails to multiple addresses does not necessarily help expedite your request). Our committed team will be readily accessible round-the-clock to address your concerns within 8 hours and take appropriate actions to rectify identified issues or support with press release removals. Ensuring accurate and reliable information remains our unwavering commitment.