Private and sovereign language models, kept inside your boundary.

Three questions decide whether a model is private.

A deployment is private when three answers fit in one sentence each and the contract says the same: where the model runs, where your data is stored, and who can reach either.

Many offers sold as 'private AI' answer only the second: your documents sit in a region you picked, and every question still travels to someone else's model. That can be a sound choice, if it is made in writing.

The assistant that answers from your documents, citing file and page, is on the knowledge base page, and the two are usually built together.

The data decides where the model runs.

The three options trade control against the work of running it. When we host an open-weight model, the model and your data both stay in Germany, inside the EU. Many systems combine two options: open weights for everything sensitive or high-volume, and an approved provider API for the few steps where hard reasoning earns its price.

Each model is named with its licence.

We choose per job, and the proposal names each model with its licence and the terms a business should know.

• Meta Llama, for general self-hosted work. The Llama 3.1 Community License allows commercial use, but a licensee above 700 million monthly active users at the model's release needs a separate licence from Meta, a product or service you make available with it must display 'Built with Llama', and use is bound by Meta's acceptable use policy. For the multimodal models in Llama 3.2, the licence rights are not granted to a company whose principal place of business is in the European Union.
• Mistral, for efficient inference on high-volume classification and extraction. Mistral Small 3, a 24-billion-parameter model, is released under the Apache 2.0 licence, and Mistral states that once quantised it runs on a single RTX 4090 graphics card.
• Qwen, for multilingual work. The open-weight Qwen3 models are released under Apache 2.0 and list support for 119 languages and dialects, Arabic among them.
• Whisper-class speech models for transcription, and embedding and reranking models for retrieval. These almost always run on your side, because recordings are sensitive and the retrieval models decide what the main model gets to read.

A licence is a legal document and we are not your lawyer, so it is named before anything is built.

Open weights are good enough for most business work.

Retrieval, extraction and summarising are most of what internal systems ask of a model, and there a well-chosen open-weight model is, in our view, comparable to the largest hosted models. Those still lead on hard multi-step reasoning, such as working a long contract through to a conclusion.

The choice comes down to these.

• Whether the data may leave your company. If it may not, the shortlist is open weights on hardware you control.
• What a wrong answer would cost. A silent mistake deep in a chain of reasoning is where a hosted model earns its premium, and sorting ten thousand short messages needs no such model.
• What it costs each month at your volume. We estimate it from your own numbers, because a per-token price looks small until it is multiplied.

Whichever model wins gets no authority over money or records. Those actions are gated in code outside the model, and a person approves each one.

Every approved API is held to no-training terms.

We read them on 23 September 2026.

• OpenAI does not train its models on API data unless you opt in. Its abuse-monitoring logs are kept for up to 30 days unless the law requires longer, and keeping content out of them needs OpenAI's prior approval for Zero Data Retention or Modified Abuse Monitoring.
• OpenAI lists the United Arab Emirates among its API data residency regions, with both storage and processing in-region, for eligible customers approved through its sales team and set up per project.
• Anthropic's commercial terms state that it 'may not train models on Customer Content from Services'.

A hosted API is used only under terms like these and after your written approval, and since terms change, the proposal names the version in force that day.

Does data protection law say where a model has to run?

Not in one sentence, and nothing here is legal advice. Take the UAE as an example. Federal Decree-Law No. 45 of 2021, its federal data protection law, was issued on 26 September 2021 and leaves several regimes in place: those of the DIFC and ADGM financial free zones and Dubai Healthcare City, and the onshore laws on health data and on banking and credit data. Its rules on sending personal data abroad turn on which territories the UAE Data Office approves, and DLA Piper's summary notes that further detail is still awaited.

Which regime applies depends on your licence and your data, and that is for your lawyer. The contract answers the technical half: which model runs where, what is stored where and for how long, and who can reach it.

Hardware sized from your real volumes.

Three numbers set the hardware: the size of the model, how many people use it at once, and how much text each request carries. A quantised model in the 24-billion-parameter class runs on one high-end graphics card, while larger models and heavy concurrency need data-centre GPUs. The proposal states the hardware before you commit.

We run no data centre and own no GPU fleet. When we host, capacity is provisioned for your system in the jurisdiction the contract names, and its cost sits inside the monthly figure you were quoted.

After launch it runs like everything else we host.

• Separate from every other client, down to its own container, database and credentials.
• Secrets in a vault, never in a repository or a configuration file.
• Blue/green releases through the same release gate as everything else we run.
• Backups proven by test restores, under a paid plan.

Cost ceilings, drift alarms and tested upgrades for a model in production sit under model operations (LLMOps).