For work that can’t go to an outside AI company.
Some businesses can’t use public AI services the way everyone else does — because of privilege, patient privacy, export controls, client contracts or public records law. A private platform lets them use the same technology on infrastructure they control.
A private system doesn’t make an organization compliant by itself. It gives you control over where data goes, so your compliance program can cover AI the same way it covers everything else.
Law firms
Most firms do well hosted in their own cloud account. Firms with clients who require data to stay in the office, or with heavy litigation document loads, go on-prem.
Hosted or on-premAccounting & financial services
Hosted fits most firms: workloads are seasonal, and GPUs can scale up for tax season and down afterward.
HostedHealthcare
Hosted works under your cloud provider’s business associate agreement. Practices that want no outside party involved at all go on-prem.
Hosted or on-premEngineering & architecture
Hosted fits most firms; project archives are large but usage is moderate and varies with the project load.
HostedDefense contractors & manufacturers
On-premises inside your assessed boundary is the usual fit. Hosted is possible only in AWS GovCloud or Azure Government.
On-premisesPublic sector
On-premises is the usual fit. Government cloud regions are an option where agency policy allows.
On-premisesLaw firms
Hosted or on-premABA Formal Opinion 512 tells lawyers to understand how an AI tool handles client information and, for many uses, to get informed client consent before entering it. A boilerplate clause in an engagement letter isn’t enough.
A private system takes the outside AI company out of the picture, which makes the confidentiality conversation with clients much simpler.
Most firms do well hosted in their own cloud account. Firms with clients who require data to stay in the office, or with heavy litigation document loads, go on-prem.
Accounting & financial services
HostedClient tax returns, statements and account records fall under the FTC Safeguards Rule and, for advisers, SEC privacy rules. Every outside service that sees them is another provider to oversee.
A private system keeps client financial data inside your own environment and connects directly to the ledgers and document systems where the work happens.
Hosted fits most firms: workloads are seasonal, and GPUs can scale up for tax season and down afterward.
Healthcare
Hosted or on-premAny outside AI service that touches patient information becomes a business associate, with an agreement, a risk assessment and an audit trail to maintain. HIPAA’s audit-control requirement applies to whatever processes the data.
With open-weight models on your own infrastructure, there’s no AI vendor in the PHI flow. Prompts, users, times and model versions are logged on your system.
Hosted works under your cloud provider’s business associate agreement. Practices that want no outside party involved at all go on-prem.
Engineering & architecture
HostedDrawings, specifications and project files are the firm’s intellectual property — and often the client’s, under contract terms that restrict where they can be shared.
A private system lets staff search and draft across years of project files without handing them to an outside AI company.
Hosted fits most firms; project archives are large but usage is moderate and varies with the project load.
Defense contractors & manufacturers
On-premisesControlled Unclassified Information must stay in systems that meet NIST SP 800-171, and cloud services handling it must meet FedRAMP Moderate-equivalent requirements. Export-controlled technical data adds ITAR and EAR. Even with CMMC Phase 2 suspended in July 2026, those obligations still apply.
An open-weight model running inside your own enclave can be documented in your system security plan like any other system you control.
On-premises inside your assessed boundary is the usual fit. Hosted is possible only in AWS GovCloud or Azure Government.
Public sector
On-premisesAgencies hold records that must stay on systems the agency controls, and many work under CJIS or state records rules that limit where data can be processed.
A private system gives staff modern AI tools while records stay on agency infrastructure, under agency retention rules.
On-premises is the usual fit. Government cloud regions are an option where agency policy allows.
Not on the list?
Insurers, credit unions, research groups and anyone with proprietary data have the same need. Tell me about yours.