Private AI and data sovereignty

The AI runs where your data already lives.

Open-weight models served inside your own cloud, private retrieval over your own documents, and a policy and redaction gateway that logs every request before it is made. For the workloads that were never going to be allowed out of the building.

Start a 10-day AI Optimization AuditSee all AI capabilities

The architecture

Where your data actually flows.

Four stages, and every one of them inside your perimeter. The point of the diagram is the box, not the arrow.

FIG.01 — Request path, fully self-hosted posture

Your environment

  1. 01

    Your data stores

    Documents, tickets, records and the vector index built from them stay in the systems and accounts you already control. Nothing is copied into a vendor's index to be searchable.

  2. 02

    Policy and redaction gateway

    Every request passes one gate: who is allowed to ask what, which fields are stripped before the request moves on, and a log entry written before the model is called rather than after.

    The control point

  3. 03

    Model serving in your VPC

    Open-weight models — Llama, Mistral, Qwen — served on your own GPUs or in your own cloud account through vLLM or Ollama. In this posture no third-party inference call exists in the path.

  4. 04

    Response and audit log

    The answer comes back with the sources it was grounded in, alongside a record of who asked, what was retrieved, which model answered and what was redacted on the way.

The models change. The boundary doesn’t.

Choosing a posture

Three ways to draw the line. Most companies pick the middle one.

Private AI is not one architecture, and the strictest option is not automatically the right one. Each of these buys something and costs something, so both are printed on the card.

01Boundary added

Frontier API, guarded

You keep using the best available models, and we put the boundary in front of them: sensitive fields redacted before the call, zero-retention terms in place with the provider, policy on who may ask what, and an audit log you own.

Best for
Teams whose constraint is contractual and auditable rather than absolute.
What it costs you
Inference still happens on someone else's hardware. That is a control, not residency, and it should never be described as the latter.
02Hybrid routing

Sensitive in, everything else out

A router classifies each request. Anything touching the data classes you have named runs on a model inside your own environment; everything else goes to a frontier API under the same redaction and logging. One gateway, two destinations.

Best for
Most companies. A minority of traffic is genuinely sensitive and it is rarely the expensive part.
What it costs you
You are running two paths, so the classifier becomes a thing that has to be right. We build it with evaluations and fail it closed, toward the private side.
03Fully self-hosted

Open weights, your environment

Llama, Mistral or Qwen served on your own GPUs or in your cloud account through vLLM, with private retrieval over your own stores. No third-party inference call exists in the path — no provider to trust, no retention window to negotiate.

Best for
Regulated data, contractual residency requirements, air-gapped environments, and anything a regulator may ask you to reconstruct.
What it costs you
You take on GPU capacity and the operations that come with it, and you give up the top of the frontier reasoning curve. We size both honestly before you commit.

Which of your workloads belongs on which side is a decision for your risk owner, not for us. The audit produces the list and the evidence; you draw the line.

Where the line is

What stays inside, and what we refuse to claim.

This is the section to read closely and quote to whoever signs off on where your data is allowed to be.

What never leaves your environmentIn the fully self-hosted posture

  • Your documents and records. Retrieval runs against stores in your own accounts. There is no upload step into anything of ours, because there is nothing of ours in the path.
  • Your embeddings. The vector index is derived from your documents and is as sensitive as they are, so it is built and served inside your environment rather than in a hosted vector service.
  • Your prompts and completions. In the self-hosted posture there is no external provider to send them to and no provider-side retention window to negotiate. The only log is the one you own.
  • Anything you fine-tune. Adapters trained on your data are your artefacts, in your registry, under your accounts. They are not pooled, reused for anyone else, or held anywhere we control.
  • Your keys and your accounts. Where a frontier API is still in the mix, the credentials are yours and the billing relationship is yours. We do not sit between you and a provider, and we take no margin on your spend.

What we never doOn any posture, including the convenient ones

  • We never train on your data. Not for our models, not for a shared evaluation set, not anonymised, not aggregated. Your data is used to build your system and for nothing else.
  • We never route your traffic through infrastructure we own. There is no Zylen gateway, proxy or router in the path. Everything we build runs in your accounts, which is also why nothing breaks when the engagement ends.
  • We never say self-hosted means safe. Self-hosting moves the trust boundary inside your perimeter; it does not remove it. Anyone with production access to the cluster can see what passes through it, so access control and logging are part of the build, not an afterthought.
  • We never make the residency claim for a hybrid setup. Where a request reaches a frontier API, the honest claim is redaction before the call plus zero-retention terms — a real control, and a weaker one than in-VPC serving. We will not let the stronger sentence be used for the weaker architecture.
  • We never tell you that you are compliant. We build controls and produce the evidence: what is logged, what is redacted, where inference happens, who can reach it. Whether that satisfies GDPR, DPDP, HIPAA or your regulator is a determination for your counsel, not a line in our proposal.

Straight answers

The questions buyers actually ask.

One workload. Ten days. Fixed price.

Find out which workloads could run inside your walls.

Tell us what you are running and what your risk owner has already refused to approve. The audit meters the AI you have, ranks it by cost and exposure, and moves one workload into your own environment so the architecture is a thing you can inspect rather than a diagram.

Start an AI Optimization Audit