Private, On-Premise and Privacy-First AI
For companies that cannot or will not send their data outside, the options and trade-offs of running AI on your own servers with open-weight models, or under strict contractual and access controls.
The problem
You want AI — but the data can't leave the building
Law firms, healthcare providers, financial companies and manufacturers doing R&D all want to benefit from AI, but client files, patient information, financial records or design documents can't be sent to a third-party service. In Türkiye, transferring personal data abroad has been subject to separate rules under the data protection law (KVKK) since 2024, and many companies' own security policies forbid it outright. The result is either staff turning to unapproved tools or AI being shelved altogether.
- Sensitive data can't be sent to third-party services
- Transferring personal data abroad carries its own legal obligations
- Staff may turn to unapproved tools
- It's unclear which data is processed where
The solution
You decide where your data is processed
We start by classifying your data: what may leave, and what must never leave. On that basis one of three setups — or a mix — is chosen: running an open-weight model on your own servers or in a private cloud; using a cloud provider whose data-processing terms are fixed in a contract; or masking sensitive data before it ever reaches a model. All access is limited by your own user permissions and every use is logged. We are open about the trade-offs from the start: local models give you more control, but they cost more in hardware, maintenance and capability.
Possible benefits
- Sensitive data stays within the boundaries your company sets
- Which data is processed where is documented and auditable
- Staff get an approved, traceable AI tool
- Changing the model or provider doesn't change the rest of the application
How it works
- 01Your team
Data classes and rules are set
What may leave and what may not — together with your legal and information security teams.
- 02Your team
The setup model is chosen
An open-weight model on your own servers, a contracted cloud provider, or a mixed setup with masking.
- 03System
The model and access controls are put in place
User permissions, logging, usage limits and an off switch.
- 04AI
AI works within the permitted boundary
Summarising, answering questions, preparing drafts — the data never leaves the agreed environment.
- 05Your team
Use is reviewed regularly
Logs, access and quality are reviewed periodically; model updates are tested before they're adopted.
Example: a law firm working with case files
The firm wants its lawyers to be able to summarise long files and correspondence quickly, but will not allow client information to go to any service outside the firm. An open-weight model runs on the firm's own server, and lawyers can select only the files they are authorised to see to get a summary and a draft chronology. Legal judgement, and every text sent to a client, stays with the lawyer. Before going live, test files are used to measure where the local model may fall short of larger cloud models on certain tasks.
What it needs
Information required
- A data classification: which data may be processed in which environment
- Users, roles and file access permissions
- Masked sample documents for quality testing
Systems to connect
- Your own servers or a private cloud; GPU hardware if needed — assessed against requirements
- Open-weight models and the tools that serve them (for example, open-source servers such as Ollama or vLLM)
- Your identity and permission system, and document systems (connected during setup)
Where a person approves
Which data is processed in which environment is decided by your legal and information security leads, not by the AI. Every text the AI produces is checked by an expert before it goes outside the company, for example to a client or a public authority.
Security and privacy
- With an on-premise setup, data never leaves the infrastructure you designate; where cloud is used, data-processing terms are set by contract
- Where personal data would be transferred abroad, the rules introduced by the 2024 KVKK amendment (such as standard contracts and notifying the Authority) are assessed with your legal adviser
- Access is role-based and every use is logged
- Model files and tools come from trusted sources, versions are pinned and updates are tested before being applied
What it does not do
- Open-weight models running locally may be less capable than large cloud models on some tasks
- Hardware, energy and maintenance costs sit with the company, and keeping things current is ongoing work
- We don't train models; we connect ready-made open models to your infrastructure and your data
- It is not a substitute for a legal compliance review; the technical setup runs alongside legal advice
Which part of your data should never leave the company?
Let's start with your data classes and lay out the setup options, with their hardware and maintenance trade-offs, in a table you can decide from.
Related services
This is an example scenario, not a completed client project. Setup and results depend on your business data and the systems you use.