WiseAI Council is built for SOC 2, HIPAA, HITRUST and ISO 27001 environments and is ready for PHI and PII from the first request. Six controls sit between your data and any AI model: access, a Sentinel scan for PHI, PII and secrets, a compliance gate, approved models only, retention limits and an append-only audit trail. The Council keeps its model line-up current, excluding models that do not meet a data lane's terms and moving work to the next best approved model when one is phased out. Spending ceilings, alerts and itemized costs keep AI spend predictable for finance.
WiseAI Council is built for SOC 2, HIPAA, HITRUST and ISO 27001 environments and is ready for PHI and PII from the first request. It is WiseTREND's multi-model AI service: several AI models from different vendors work on your question or document and review each other, and you get one answer back. This post covers what sits around that answer: the controls that protect your data, how the Council keeps its model line-up safe and current, and how it keeps AI spending inside the limits you set. For how the Council works as a whole, see WiseAI Council: One Reviewed Answer From Many AI Models.
What security and compliance come with WiseAI Council?
WiseAI Council is operated by WiseTREND, which holds HIPAA, SOC 2 and HITRUST among its 23 security and government certifications. The Council runs under the same security program, with controls aligned to ISO 27001. You do not assemble compliance from parts: the agreements, the data rules and the audit trail are in the product, and they apply to every request whether it comes from the dashboard, your own system over the API or an AI agent.
- Access. People sign in with their WiseTREND One Portal account, with administrator and member roles. Systems use named API keys that are stored only as hashes and can be revoked at any time. Every organization's keys, requests and audit records are isolated from every other organization's.
- Sentinel scan. Every request and every answer is scanned for PHI, PII and secrets. A credential or secret in a request is a hard stop. The data label on a request can be raised by the Council but never lowered, and anything with an attachment is at least confidential.
- Compliance gate. Before any model is called, the Council checks the signed agreements, your data residency requirement, each provider's terms and your spending ceilings. A request that is not allowed is refused with a clear reason, is never charged and never reaches a model.
- Approved models only. PHI goes only to generally available model deployments covered by a Business Associate Agreement. Preview models never see PHI. Every provider is used through its commercial API under no-training terms, and processing stays in the United States.
- Retention. Content is encrypted in transit and at rest and is purged automatically after 30 days, 7 days for PHI. You can set a shorter period per API key or delete a request immediately with one API call.
- Audit. Every routing decision, refusal, model call and purge is written to an append-only audit log. The log holds shapes and counts, never your data, so it can be shared with an auditor without creating a new exposure.
How is PHI and PII handled?
Each request is labelled standard, PII, confidential or PHI, and the label decides what the Council may do with it. Your administrators sign the Data Processing Agreement (GDPR, CCPA and GLBA terms) and the HIPAA Business Associate Agreement online in the dashboard, with nobody at WiseTREND in the loop, and can view or terminate them the same way.
WiseAI Council's shared learning, which improves form-level guidance across customers, uses only de-identified information after screening and human review, and any organization can opt out.
How does WiseAI Council choose which AI models to trust?
AI models change every few weeks. New ones launch, prices move, previews become generally available and older models are retired. A team that wires a single model into its systems has to track all of that and rewrite code when a model goes away. WiseAI Council does it for you.
This is not a hypothetical. On September 30, 2026, the day this post was published, Anthropic e-mailed its API customers that Claude Sonnet 4.5 will be retired on November 24, 2026, with reduced availability from October 30, and that customers must upgrade to a newer model before then to avoid service interruption. Every team that calls that model directly now has to find each place it is used, change and retest its code, and repeat the exercise at the next notice. WiseAI Council customers have nothing to do.
- Include and exclude. The Council keeps a catalogue of every model it may use, with its vendor, quality tier, price, launch date and retirement date. A model is cleared only for the data lanes its terms allow: the PHI lane accepts only generally available deployments under a Business Associate Agreement. Your administrators can also limit which vendors your account uses.
- Phase-out without breakage. When a model reaches its retirement date, it stops receiving new work and the next best approved model takes its seat, on the same data lane and at the same quality level. Your integration does not change.
- Failover. If a model is down or rate limited, its seat fails over to the next best approved model. A second opinion always comes from a different vendor, so a failover never turns a review into a model checking its own work.
- Visible. Each result shows which models did the work. The dashboard lists the catalogue with prices and dates and when it was last checked.
How does WiseAI Council control AI spending?
AI usage can grow faster than anyone planned: a loop in an integration, a new team discovering the tool, a batch much larger than expected. WiseAI Council checks spending before any model is called, not after the invoice arrives.
- Four nested limits. An account limit agreed with WiseTREND, a monthly and a daily ceiling that your administrators set, and your prepaid balance (or a monthly invoice). A request that would cross any of them is refused with a clear reason and no charge.
- Alerts before the limit. Administrators get an e-mail when a limit is 80% used and when it is reached, when a limit or the balance changes, and when an API key is created or revoked. Each notification can be switched off.
- No silent downgrades. The Council never moves a request to a cheaper model to save money without telling you. A request already in progress finishes.
- Every cent itemized. Each request shows every model used with its tokens, time and charge, and can carry your own reference, such as a batch or document ID, so each charge links back to a record in your system.
What does this mean for InfoSec, the business and finance?
| For | What you get |
|---|---|
| InfoSec and compliance | One controlled path to many AI models instead of teams signing up for tools on their own. PHI and PII rules enforced in code before any model call, secrets blocked, no-training terms, encryption in transit and at rest, retention limits and an append-only audit log you can hand to an auditor. |
| Legal and privacy | DPA and HIPAA BAA signed and terminated online. Every provider's terms and each model's lifecycle are tracked for you, and preview models never see PHI. |
| Business and operations | Answers reviewed by models from different vendors, with the disagreement written down. No outage or model retirement breaks your workflow, and no code changes when the model line-up changes. |
| IT and developers | One API and one set of keys for every vendor. Clear refusal codes, automatic failover and a model catalogue that stays current without upgrades on your side. |
| Finance | Usage-based pricing with no minimum and no contract. Ceilings checked before spending happens, alerts at 80% and 100%, a charge for every request linked to your own reference, usage summaries and CSV export for any date range, and payment by card, ACH, wire or NET 30 invoice. |
How do you get started?
Sign in with your WiseTREND One Portal account at my.wisetrend.com/wiseai. New organizations start with $10 of free credit. Sign the DPA or the BAA on the Data protection page if you will send personal or health data, set your spending ceilings on the Billing page, and run a first request from the Try it page. The full feature list is on the WiseAI Council product page.
If your security team needs a questionnaire answered, evidence for an audit or help fitting the Council into a regulated workflow, talk to our team.