AI that never leaves the building.
Some data cannot go to a cloud. Not ours, not anyone’s. For that work we build the whole system on hardware you own: a desktop application, a local backend, and open-weight models served inside your walls. This page is the short version of the reference architecture; the full document is available on request.
Sovereign is four tests.
Vendors stretch the word to cover almost any managed endpoint. Ours is narrow, and every part of it is testable on the machine in front of you.
Ownership
You hold root on every machine, every credential, and the model weight files on your own disks. There is no vendor account the system depends on.
Locality
Inference, storage, and application logic execute on machines you control, on premises or in a facility you choose.
Disconnection tolerance
The system keeps working with the network cable unplugged. The acceptance suite runs on a machine with no route to the internet, and it has to pass there.
Permissive licensing
Every runtime component ships under a licence that cannot be remotely revoked and does not meter usage. A model you rent is not sovereign, wherever it runs.
Three planes, all on your hardware.
The application plane
A desktop application built from one codebase on the operating system’s own webview: Tauri 2 by default, Electron or fully native where the work demands it. It talks to the local backend and nothing else. No analytics, no third-party crash reporting, no update pings; updates arrive as signed offline bundles.
- Tauri 2
- Electron
- Native
The data plane
The same platform our cloud work runs on, brought up with Docker Compose on your servers: Postgres, auth, API, realtime, and storage behind one gateway. Row-level security is enabled and forced on every table, and the isolation harness that proves our own posture on every commit runs in your CI, proving yours. Embeddings sit in pgvector beside the rows they describe.
- Self-hosted Supabase
- FORCE RLS
- pgvector
The inference plane
Two tiers of open weights. Gemma 4 answers the interactive work from a single workstation GPU, under Apache 2.0. GLM-5.2, the strongest model you can own outright, serves long-horizon reasoning from a dedicated GPU node, under MIT, and it is optional: a deployment that never needs million-token reasoning does not buy the node. EmbeddingGemma produces the vectors. Both tiers speak the same API, so each model is replaceable the day something better ships.
- Gemma 4
- GLM-5.2
- EmbeddingGemma
The controls come with us.
We operate under the same controls a sovereign build installs on your hardware, and we do it in public. The proof below is live.
What we won’t show you
We won’t show you a logo wall of sovereign deployments. We don’t trade on client names. What we can show is the posture we hold ourselves to, live: the isolation harness green on every commit, residency and retention in writing, the subprocessor register down to the last entry. A sovereign build inherits every control on that list.
The long versions.
AI that never leaves the building
Why the capability tax on local AI collapsed in 2026, the pair of models, and what a sovereign build honestly costs. Six minutes, thirteen cited sources.
The full document, on request
Hardware profiles from laptop pilot to eight-GPU node, the air-gap delivery procedure, and the complete licensing inventory. Gated like our security questionnaires: tell us who you are and it arrives by email.
Everything else we build
Web platforms, mobile, and desktop: the same discipline on every surface, and the two ways into an engagement.