Capitol AI builds the AI stack that never leaves the building

By now, most regulated institutions have run the same experiment. Someone senior asks why the firm isn't using AI yet. A team scopes a pilot, picks a vendor, and gets a demo everyone loves. Then the pilot lands on the desk of a compliance officer, who asks one question: where does our data go? The answer is almost always "to the vendor's cloud," and that is where the project dies.

This is not compliance being obstinate. A bank's loan files, a law firm's client documents, an agency's case records are the most sensitive material those organizations hold. Shipping them to a third party's servers so a model can summarize them is, for many of these institutions, somewhere between a contractual breach and a legal impossibility. The result is a strange standoff: the organizations that would benefit most from AI, the ones drowning in documents and reports and reviews, are the ones least able to adopt it.

Capitol AI is built for the institutions stuck in that standoff. The Washington, DC company calls its product the sovereign operating system for intelligence: a platform that runs entirely inside the customer's own infrastructure, in their cloud tenant, their data center, or a secure network, and turns their proprietary data into the finished work products those institutions run on, from due diligence reports to regulatory documentation. The data never leaves. There is no egress to a vendor's cloud, because there is no vendor cloud in the loop at all.

The question compliance actually asks

It helps to be precise about why AI adoption stalls in regulated industries, because the reason is narrower than "banks are slow."

Most modern AI products are delivered as SaaS. The customer's data flows to the vendor, gets processed by models the vendor chooses, and the results flow back. That architecture is fine for a marketing team drafting blog posts. It fails for a bank evaluating an acquisition, a fund running diligence on a target, or an agency handling records it is legally required to keep inside its own boundary. In those settings, data residency is not a preference. It is written into client agreements, regulatory frameworks, and in the government's case, law.

There is a second problem layered on top: accountability. When a regulated institution produces a document that informs a decision, it has to be able to show its work. Which sources fed the analysis, who approved the workflow, which model produced which paragraph. A consumer chatbot offers none of that. An examiner asking "how was this report produced?" is not going to accept "we pasted it into a chat window" as an answer.

So the real requirement was never a smarter model. The models are plenty smart. The requirement is an AI system that lives where the data lives and leaves an audit trail a regulator will accept. That is the product Capitol decided to build.

What a sovereign AI stack looks like

Capitol's platform is a full working environment rather than a single model endpoint, and its design choices map directly onto the two requirements above.

The first choice is deployment. Capitol runs in a single-tenant environment the customer controls. That can be the customer's own cloud tenant, their physical data center, or an isolated secure network. The company's materials describe this as sovereignty: the institution owns the environment, the data, and the outputs, the same way it owns its databases today. For a government customer or a bank under strict residency rules, this is the difference between a product that can be bought and one that cannot.

The second choice is that the platform is model agnostic. Capitol does not sell its own frontier model, and it does not lock the customer to anyone else's. It routes work across whatever models the institution has approved, which means a firm can use one model for drafting, another for analysis, and swap either out when something better or cheaper appears. In a market where the underlying models leapfrog each other every few months, the institution's investment sits in the workflow layer, not in a bet on a single lab.

The third choice is governance as a feature rather than an afterthought. The platform carries data permissions, workflow controls, evaluations, and audit trails through every step, so an output can be traced back to its sources and its approvals. Capitol describes what comes out the other end as decision-grade artifacts: due diligence reports, regulatory documentation, executive intelligence. The phrase is doing real work. Plenty of systems write fluent text; the claim here is that an institution can act on these documents and defend them later.

Customers come from the sectors you would expect given that design: financial services, professional services, media, and government. Pricing is custom and sales are demo led, which is the honest shape of a product that gets deployed inside someone's infrastructure rather than signed up for with a credit card.

The road here ran through storytelling

Capitol did not start as an enterprise infrastructure company, and the detour is worth recounting because it explains why the product looks the way it does.

The company was founded in 2021, and its first act was a generative research tool, publicly launched in 2023, that turned data and live research into structured narratives and reports. The pitch then was "create powerful content from data," aimed at researchers and analysts who needed to go from raw material to a readable document quickly. That version of Capitol attracted serious money early: a $10 million seed round in late 2022 led by 468 Capital, with participation from Designer Fund, Fuel Capital, and a run of notable angels including Airbnb CEO Brian Chesky and Tiger Global founder Chase Coleman.

In 2024 the company went through Y Combinator's Summer batch, and by its own account led that batch in revenue. Somewhere in that stretch the center of gravity moved. A hosted research tool has an obvious ceiling: the organizations with the deepest need for automated research and reporting were precisely the ones that could not use it, for the data-boundary reasons above. A policy analyst can paste public material into a web app. A diligence team at a fund cannot.

Capitol followed that constraint down the stack. The report generation engine remained, but the company rebuilt the delivery around it: single-tenant deployment, model routing, permissions, audit. What looks like a pivot is closer to a repackaging for the customers who valued the product most and could pay the most for it. The ambition grew in the process. A report tool is a feature; the system of record for how an institution produces intelligence is a platform.

A designer and a government technologist

Capitol's founding pair explains both halves of the product: why it is pleasant to use and why it is built for institutions most startups avoid.

Shaun Modi, the CEO, was a founding member of Airbnb's product design team. That pedigree shows up in a part of enterprise software that usually gets neglected. Tools deployed inside government networks and bank perimeters are famously ugly and famously hard to use, partly because the buyers are not the users. A founder who helped set the design culture at one of the most design-driven consumer companies ever built is an unusual person to find selling to compliance departments, and it gives Capitol a wedge incumbent government contractors cannot easily copy.

Tom Hallaran, the CTO, spent his previous career on the buyer's side of the table. He directed the AI Center of Excellence at the General Services Administration, the federal office that helps US agencies figure out how to adopt AI. It is hard to imagine better preparation for this company. Hallaran has watched, from inside the government, exactly where AI projects stall: the security reviews and data-handling rules that kill pilots before they reach users. Capitol's architecture reads like a list of answers to objections he spent years hearing.

The company's name and headquarters follow from that history. Capitol is a Washington company in substance: one founder who knows how the public sector buys technology, selling the private sector's most regulated industries a product shaped by the constraints he learned there.

The bet on the layer above the models

Strip away the deployment details and Capitol is making one strategic claim: in regulated industries, the durable layer of the AI stack is not the model. It is the governed workflow that sits above the models.

The reasoning goes like this. Frontier models are converging in capability and falling in price, and no institution wants its process welded to a single lab's API. What does not commoditize is everything around the model: where the data sits, who approved the workflow, how outputs get traced, evaluated, and signed off. Those properties are specific to each institution, they take years to embed, and once embedded they are what an auditor, a client, or an inspector general actually examines. The lab that trained the model is interchangeable. The system that can prove how a report was produced is not.

That is also the moat argument. A hosted AI company competes on model quality and loses sleep over every lab release. Capitol competes on trust and deployment, where the competition is not other startups but the status quo of analysts assembling reports by hand because nothing else clears review. If Capitol's platform becomes the way a fund produces diligence or an agency produces assessments, replacing it means re-clearing security review and re-proving an audit chain from scratch. Enterprise software built into the boundary of an institution tends to stay there.

None of this makes the road easy. Selling into governments and banks is slow, and every deployment inside a customer's infrastructure is heavier to deliver than a SaaS login. But the prize is proportional to the difficulty. The institutions behind the firewall hold the most consequential documents and decisions, and the budgets to match, and almost the entire AI industry is structurally unable to serve them.

Capitol raised real money early and picked the customers everyone else's architecture rules out. The companies that win regulated markets usually look like this at the start: patient, a little unglamorous, and standing where the requirements are hardest to meet. Capitol has been standing there since 2021.