Your data stays in your environment.

With a public AI service, every prompt and every document goes to an AI company to be processed. With a private platform, the models run in your own environment — your isolated cloud account or your own hardware — and no AI company is involved. That one difference is what the rest of this page is about.

Where your data goes

Your environment — your cloud account or your building

Your staffSigned in through your existing directory

Private AI platformOn GPUs dedicated to you

Models
Document index
Conversation history
Audit log

Your systemsFile shares, email, accounting, ERP — only what you connect

NOTHING SENTto OpenAI, Google, Anthropic, Microsoft or any other outside AI provider. Outbound internet is off by default, and there are no public endpoints.

The controls

Each one is configured, tested and written up in the as-built record you receive.

IdentitySingle sign-on with your directory; MFA via your provider

AuthorizationRole- and group-based access to models, documents and tools

Document permissionsAnswers only from files a user can already open

Audit loggingUser, time, prompt, model version, response

Log handlingRetained on your system, exportable to your SIEM

EncryptionAt rest, with keys you control; TLS in transit

NetworkPrivate network, no public endpoints, outbound blocked by default

IntegrationsLeast-privilege, read-only unless you approve more

UpdatesSigned, tested packages; offline for air-gapped sites

PhysicalYour hardware, or your provider’s certified data centers

Air-gapped when it has to be

Some environments can’t have any internet connection at all. On-premises systems can run fully air-gapped: models, software and updates are delivered as verified offline packages and installed by your staff under your change process.

Nothing on the system phones home. There is no licence server, no telemetry and no remote access unless you decide to set one up.

How it maps to your obligations

A starting point for your compliance team, not legal advice.

Framework	What it asks for	How a private platform helps
HIPAA Security Rule	Access controls and audit controls (45 CFR 164.312) on systems that handle PHI; business associate agreements with vendors who touch it.	No AI vendor in the PHI data path. Hosted systems run under your cloud provider’s BAA; on-prem needs none for the AI itself. Per-user access and a full audit log either way.
NIST SP 800-171 / CMMC	110 security requirements for systems holding CUI; FedRAMP Moderate-equivalent controls for cloud services that handle it.	On-prem inside your assessed boundary, or hosted in AWS GovCloud or Azure Government, documented in your system security plan.
ITAR / EAR	Export-controlled technical data kept from unauthorized foreign persons and systems.	On-prem, or a U.S. government cloud region, with access tied to your existing user controls.
ABA Formal Opinion 512	Understand how AI tools handle client information; protect confidentiality under Rule 1.6; informed consent for many uses.	Client information is processed on the firm’s own system, with no AI company in the data path.
FTC Safeguards Rule (GLBA)	A written information security program, access controls and oversight of service providers.	Fewer outside providers to oversee; access control and logging inside your existing program.

Bring your security questionnaire.

Send the questions your compliance team needs answered. I’ll answer them in writing as part of the assessment.

Request a private AI assessment mrtorino@gmail.com