How does Protocol Safe preserve sponsor protocol IP?

By architecture, not by promise. The protocol PDF is ingested into a retrieval store that sits inside the sponsor's own cloud tenancy. The retrieval agent runs in that tenancy. The query Burna AI sends in is the de-identified adverse event narrative; the response is a structured per-drug attribution probability score. Content boundary middleware fail-closes against any response that contains protocol text. Burna AI cannot read the protocol, cannot inadvertently train on it, and cannot exfiltrate it. The sponsor IP stays inside the sponsor cloud at all times.