Service 02

Private, self-hosted & air-gapped AI

Open-weight models on infrastructure you control, up to a network with no egress at all. Your data stays inside your boundary, and you can prove it.

From £18,000 4-8 weeks Fixed fee

Book a 30-minute call + Pricing

The problem this solves

The value is obvious and the data is why it has not happened: patient records, privileged material, unpublished financials, case files, citizen data. Nobody wants to explain sending that to an API in front of the information governance board.

The usual response is to wait, or to build on synthetic data that never goes live. The alternative is to move the model to the data.

What we deploy

Open-weight models, on your infrastructure

Current open-weight models on your own hardware, or on dedicated capacity in a UK region on a contract you hold. Served through a proper inference stack: batching, quantisation where it does not cost accuracy, and capacity sized against measured demand.

An interface you own

Applications talk to an internal interface, never directly to a model. That lets you change model, change tier, or route classifications to different backends later, without rewriting anything above it.

An evaluation set from your own material

A test set from your real documents, with reviewed correct answers, measured against the deployment. You get a number, and every later change of model or configuration becomes a decision with evidence behind it.

The evidence pack

A written statement of where processing happens, what is retained and for how long, who can access it, and the failure and exit paths. It unblocks procurement and assurance, and is about half the value of the engagement.

Air-gapped and on-premise accelerated compute

For defence and segregated government networks, the deployment tier is decided before anyone discusses models. No route to the internet means no route to a cloud region, so residency stops being the question. We have delivered air-gapped platforms on NVIDIA DGX B300 for a central government department and on NVIDIA HGX B300 for a defence organisation, both running NVIDIA AI Enterprise.

The engineering work is removing every assumption of connectivity. There are more than anyone expects:

Container registry mirrored inside the boundary, images pinned by digest rather than tag
Operating system and language package repositories mirrored and version-pinned
GPU driver, CUDA and firmware bundles staged as versioned artefacts with a tested rollback
Licensing served locally, so entitlement never needs a route out
Model weights imported as hashed artefacts, in formats that do not execute code on load
Vulnerability and CVE feeds imported on a defined cadence, like everything else

Each is a standing obligation, so each gets a named owner and update cadence before go-live. That decides whether the platform is still safe to run in year three. Raise it during procurement.

AI agents on the same estate

An agent that can call tools needs a containment boundary as well as a data boundary. NVIDIA's Open Agent Safety Platform provides one: OpenShell sandboxes agents on the host today, and Sentry will watch them from a BlueField-4 DPU. Our guide to NVIDIA OpenShell and Sentry on DGX and HGX covers what runs on BlueField-3 systems now and what it costs.

Hardened to a named baseline

Hosts, container runtime and orchestration are built from DISA STIG baselines reconciled against CIS Benchmarks Level 2, in code, and scanned before handover. Most AI platform deployments skip the runtime and orchestration layer. A hardened host running a permissive container runtime is not a hardened system.

Platforms are mapped onto the NCSC Cyber Assessment Framework and the NCSC Guidelines for Secure AI System Development. Controls are traced to NIST SP 800-53 and the NIST AI Risk Management Framework where your supply chain expects that vocabulary. The security standards page sets out what "aligned to" does and does not mean.

Choosing the tier

Three tiers. We recommend the cheapest one your data classification permits:

Air-gapped and self-hosted: your hardware, your network, and at the strictest no egress path at all. Nothing crosses the perimeter. Strongest position, highest operational burden.
Private UK deployment: dedicated instances in a UK region on your contract. Where most regulated production workloads belong.
Contracted hosted: a frontier model under enterprise terms with zero retention. Right for low-classification work.

Most engagements end up with a mix, routed by classification.

The question to ask yourself first

Private deployment fails most often because nobody owns the infrastructure after handover. Before committing, decide whether you have, or will hire, someone to own capacity, updates and incidents.

If not, say so early. There are good intermediate options, including managed private capacity. Choosing one on purpose beats finding the gap six months after go-live.

Handover is the deliverable

Everything lands in your repository: infrastructure as code, deployment pipeline, evaluation harness, runbook, architecture decision records. We run handover sessions with your engineers.

A retainer for escalation and periodic model review is available. The platform does not need it to keep working.

FAQ

Questions we get asked

Can you deliver this fully air-gapped?

Yes. We have delivered air-gapped platforms on NVIDIA DGX B300 for central government and NVIDIA HGX B300 for defence, both with NVIDIA AI Enterprise. Air-gapped is a different engineering problem from private deployment: every dependency must be mirrored inside the boundary, from container images, OS and language packages, GPU drivers and firmware to licensing, model weights and vulnerability feeds. The first deployment is the easy half. Whether it is still safe to run in year three depends on sustainment, so we design that first. The case studies show how.

What security standard do you build the hosts to?

DISA STIG baselines reconciled against CIS Benchmarks Level 2, written as code so the build is reproducible, and applied to the operating system, container runtime and orchestration layer. Scan output is part of handover. Some Level 2 controls conflict with GPU driver and scheduler operation, so there is always a short deviation list, each entry with finding ID, technical reason and compensating control. See security standards.

Do we need our own GPUs?

Often not. Dedicated GPU capacity in a UK cloud region gives residency and isolation without buying hardware, and suits most regulated workloads. Owned hardware makes sense when you need physical control, when volume is high and steady enough to flip the economics, or when your risk position rules out a third-party operator. We model both against your projected volume before recommending either.

Are open-weight models good enough?

For what most regulated organisations want (retrieval, extraction, classification, summarisation, drafting for human review), usually yes. For the hardest reasoning, frontier hosted models remain ahead. We settle it with an evaluation set built from your own data. Published benchmarks are only loosely related to performance on your documents.

What does this cost to run once it is live?

It depends on volume and model size, but the shape is predictable: mostly fixed cost, dominated by compute, with a marginal cost per request close to zero. That is the inverse of hosted pricing, and why private deployment wins as adoption grows. The engagement includes a five-year cost model against your projected volume.

What happens when a better model comes out?

You swap it. Model access sits behind an internal interface you control, so replacing the model does not mean rewriting the applications on top. The evaluation harness turns a swap into a measured decision. We budget for the re-evaluation explicitly.

Can you work with our existing cloud and security teams?

Yes, and we prefer to. We deploy into your accounts, under your controls, using your infrastructure patterns where they exist. Your security team should review it. Everything we build is meant to be read, understood and owned by your engineers.

What if we later decide hosted was the right answer?

Then you route to it. Models can sit on either side of the boundary, and a routing layer can send different data classifications to different backends. You are not locked into the architecture we built first.

Start with a 30-minute call

No deck. Tell us the problem. We will say whether AI is the right tool, what it would take and roughly what it would cost.

Book a call Pricing