01
The runtime holds no keys
External compute receives one short-lived signed link and a callback address. It receives no storage credential, keeps nothing, and can be replaced by in-boundary hardware through one setting.
Sovereign Infrastructure · AI
The model travels. The data stays.
Open-weight models run inside your boundary or through a runtime with no credentials and nothing retained. Retrieval is permission-scoped before generation, and every read, response and revision lands in an append-only audit trail.
System map. Inside a cutaway jurisdiction boundary sit a data plane, an orchestrator acting as the single writer, an in-boundary model runtime and an append-only audit log. An external runtime sits outside the boundary and receives only a short-lived signed URL, returning text through a marked port. A severed trace marks data leaving the boundary, which never happens.
How it works
One writer, one boundary, nothing held outside it.
05 / 05The boundary holdsThe model travels to the data. The data never leaves the jurisdiction.
Sovereignty is an architecture. If it lives in a contract clause, you do not have it.
02
Out of scope returns nothing
Access rules travel with content into the index. A person cannot retrieve what they could not open, and the response does not disclose that a hidden record exists.
03
The boundary is explicit
Every unavoidable vendor edge is documented and scoped. Data residency is enforced by architecture; residual metadata paths are named instead of hidden in a contract.
Technical specification
- Models
- Open weights for transcription and generation
- Placement
- In-boundary runtime, or key-free external runtime
- Credentials
- None issued to the runtime, in either placement
- Residency
- Your cloud project, your region, your keys
- Retrieval
- Permission-scoped at index time, not at answer time
- Writes
- One ingest path, single writer
- Audit
- Append-only revisions, content hash and rationale
- Switching
- External to in-boundary is a setting, not a rebuild