Skip to content

Deployment approach

How the system is assembled.

Sovereign deployment is not a policy choice layered onto a hosted API. It is a stack you can point at: models served locally, a corpus indexed in place, adapters trained on your material, and a boundary enforced at the network layer. This is how we design those pieces to fit together.

This page describes the design. The current release is a private-pilot MVP; what it has been tested on, and what is still planned, is marked part by part on the architecture page. See the architecture and its status

The runtime

BenchmarkedQwen3 4B · LM Studio · Apple M4

Open-weight models, served where the corpus already sits.

The current release serves open-weight models through LM Studio on the host or Ollama inside Docker Compose; the published evaluation used the first. For a dedicated GPU server with continuous load, vLLM is the design target, and llama.cpp covers CPU-only or mixed environments. Neither has yet been benchmarked with the product.

Sizing starts from your document types and concurrency, not from a model leaderboard. A 7B–14B model at Q4 or Q5 quantisation will serve most narrow document work — contract abstraction, variance narrative, code search — at acceptable latency on a single consumer or datacentre GPU. We size up when the held-out evaluation shows the smaller model missing cases your reviewers care about, not because a larger number appeared on a benchmark.

Quantisation is a trade-off we document explicitly. Q4_K_M is usually the starting point: half the VRAM of full precision with a small recall cost on rare tokens. Q8 is reserved for tasks where a single misread clause or figure is unacceptable and the hardware can carry it. The point is not to run the largest model you can afford. It is to run the smallest model that passes your evaluation on your material.

For narrow document work, a well-fitted small model beats a frontier API. The API model is general; your corpus is not. Retrieval plus a house adapter on a 14B base can outperform a 70B general model on questions whose answers live in your own index, because the retrieval step does the heavy lifting and the model's job is synthesis in your register, not world knowledge.

Retrieval

The corpus is indexed in place. Citations fall out of retrieval, not from a prompt.

Your documents stay where they are. We mount the vault read-only and build an index beside it — embeddings, structured metadata, and a keyword layer — without copying the corpus to a third party or a shared tenancy.

Chunking follows document structure rather than a fixed token count. A contract is split at clause boundaries. A ledger export is split at account and period. Source code is split at function and module, with imports and call sites preserved in the metadata so cross-file questions still resolve. Fixed-size chunks produce citations that point at the middle of a paragraph; structure-aware chunking produces citations a reviewer can open and verify.

Search is hybrid: dense vector retrieval for paraphrase and concept, BM25 for identifiers, dates, amounts and proper nouns. Results are fused and re-ranked before they reach the model. The model never sees the whole corpus; it sees the passages retrieval selected, which is why hallucination on sourced questions drops sharply compared with a raw completion.

We do not ask the model to cite. Citations are assembled from the retrieval trace: each passage carries its source file, page or locator, and the answer template binds claims to those locators. If retrieval returns nothing above threshold, the system says so rather than inventing a source. That behaviour is enforced in the pipeline, not requested in the system prompt.

Adaptation

StatusPlanned · not in current release

LoRA adapters on your material. Evaluated on a set you define.

Adaptation is planned; it is not part of the current release. General models write in a generic register. Your firm does not. We will train low-rank adapters — LoRA or QLoRA, depending on VRAM — on material you designate: redacted matters, anonymised packs, approved correspondence. Training would run on the same hardware as inference, so no weights and no training data leave the boundary.

Evaluation is against a held-out set the firm defines before training starts. Typical cases: ten questions whose answers are known and documented, five document types the model must handle, three failure modes you have already seen from hosted tools. We report precision on sourced claims, refusal rate when retrieval is empty, and register drift measured against your style guide. A model that passes on our generic set but fails on yours does not ship.

Adapters are versioned alongside the base model. Rollback is a configuration change, not a retraining exercise. When your corpus shifts — a new reporting format, a merger, a regulatory change — we retrain on the delta and re-run the held-out set before the new adapter is promoted.

The boundary

Network egress denied. Keys in your custody. Updates signed and logged.

The boundary is enforced below the application layer. Egress is denied at the firewall or via host policy — not by a setting in the model server that an operator could toggle. Telemetry from inference frameworks is disabled or blocked. In the current release, the application also refuses any model endpoint that is not on the local machine or its Compose network.

In a pilot, encryption keys for the vault and the model weights sit in your custody: your HSM, your cloud KMS, your hardware security module. We hold operator credentials only for the duration of an engagement, scoped to what is needed, and revoked on handover.

For an air-gapped deployment — planned, not yet validated — model and adapter updates arrive on removable media, verified against a signed manifest, and installed through a procedure that is itself logged. The log stays inside the boundary. An auditor can reconstruct what version was running on any date and who approved the change.

Operations

Observable inside the perimeter. Versioned. Somebody holds the pager.

This is the operating model for a pilot. The current release keeps its state in memory and ships no dashboards of its own. Observability is local: request logs, retrieval traces, latency and token counts, GPU utilisation. Dashboards run on your monitoring stack — Prometheus and Grafana by default, or whatever you already operate. Nothing is shipped to our infrastructure.

In a pilot, every answer should be reconstructable from its trace: the query, the passages retrieved, the model and adapter version, the prompt hash, the output. Logs are retained according to your policy, not ours.

Models and adapters are versioned in a registry inside the boundary. Promotion and rollback are explicit operations with an approver. Capacity planning is based on measured tokens per day and peak concurrency, with headroom for batch jobs such as indexing and training.

We document who holds the pager: your team, ours, or a shared rotation. For most deployments the firm owns day-two operations after handover; we remain available on a support retainer. The runbook covers restart, rollback, index rebuild, and the air-gapped update path.

What we do not do

Honest limits, stated upfront.

We do not claim the model replaces judgment. It drafts, retrieves and reconciles. The partner, the director and the engineer sign what goes out. That is a design constraint, not a disclaimer we hope you ignore.

We do not fine-tune away hallucination. Retrieval and refusal when evidence is missing reduce it on sourced work; they do not eliminate confabulation on open questions. The integration tests include an out-of-domain question specifically to check that the system refuses it.

We do not recommend local deployment where a hosted model is genuinely fine. If your material can safely transit to an API under terms you control, and your obligation does not require physical residency, a local stack is overhead you do not need. We will say so in the diagnostic.

Start

See whether the stack fits your obligation.

The two-week diagnostic maps your corpus, names a runtime, and states plainly whether sovereign deployment is warranted — or whether a hosted model would serve you better.

Diagnostic brief

Day 14 of 14

  1. 01Where the material actually livesMapped
  2. 02What must remain a human signatureListed
  3. 03The runtime, and where it sitsNamed
  4. 04Risks we found, in plain languageWritten
  5. 05Price to install, price to keep runningQuoted

Yours to keep — for your board, your IT team or another vendor.