VDF AI runs enterprise agents where your data already lives — on-premises, in your private cloud, or fully air-gapped. Nothing depends on an external inference API. This is where your security, compliance, and procurement teams find how it works.
Every model runs inside a boundary you control. Choose the isolation level your regulators, security team, and infrastructure require — the platform is the same.
The full platform — orchestration, routing, retrieval, and models — runs on networks with no outbound internet access. Updates arrive through a controlled, offline artifact process.
Deployed on your own hardware in your data center. Data, models, and logs remain inside your infrastructure and identity boundary, governed by your existing controls.
Deployed into your own cloud tenancy (AWS, Azure, GCP, or sovereign cloud). You keep the account, the network policy, the encryption keys, and the data plane.
VDF AI plugs into the identity, logging, secrets, and network controls you already run — it does not ask you to trust a new external service.
Integrates with your existing identity provider over SAML or OIDC (Entra ID, Okta, Keycloak, LDAP). No separate user store to manage, no shadow accounts.
Granular RBAC governs who can use which agents, models, tools, and data sources. Access to sensitive workflows and connectors is scoped by role, team, and environment.
Every prompt, tool call, retrieval, model route, and response is recorded with actor, timestamp, and context. Logs stream to your SIEM for retention and investigation.
You control which models are approved, where they run, and which workloads may use them. The router enforces model policy per domain, sensitivity level, and residency requirement.
Retrieval runs against your own document stores and vector indexes inside your perimeter. Embeddings are generated locally; no content is sent to third-party APIs.
Deploys into segmented network zones with no dependency on external inference endpoints. Egress can be fully disabled for air-gapped and OT environments.
On-prem deployment is the most direct way to satisfy data-residency, sovereignty, and third-party-risk obligations. Here is how the architecture supports each framework.
| Framework | How VDF AI supports it | |
|---|---|---|
| EU AI Act | AI inventory, risk classification, human-oversight controls, and technical documentation generated from the governed workflow. See the AI Governance Framework resource. | Details |
| GDPR | Data stays in-region and inside your perimeter; no processing by external model providers. Supports data-minimization, purpose limitation, and right-to-erasure workflows. | Details |
| DORA | On-prem deployment removes third-party inference as an ICT concentration risk. Full audit trail and model governance support operational-resilience testing and reporting. | Details |
| HIPAA | PHI never leaves the covered entity’s environment. Access controls, audit logs, and encryption support the Security Rule for AI-assisted clinical and administrative workflows. | Details |
| NIS2 | Air-gapped and network-isolated deployment options for essential and important entities, with logging and access controls that map to incident-handling obligations. | Details |
This mapping describes how the platform’s architecture and controls support your compliance program. It is not legal advice; obligations depend on your deployment, jurisdiction, and use case.
No. VDF AI is designed to run entirely inside your infrastructure — on-premises, in your private cloud tenancy, or fully air-gapped. Prompts, documents, embeddings, model weights, and logs remain inside your perimeter. There is no requirement to call an external inference API.
Yes. VDF AI is model-agnostic and supports bring-your-own-models. You choose which open-weight or licensed models to run, where they run, and which workloads may use them. The router enforces your model policy per domain, sensitivity, and residency requirement.
Authentication uses your existing SSO over SAML or OIDC. Authorization is governed by role-based access control. Audit events stream to your SIEM. Secrets integrate with your existing vault, and encryption keys can be customer-managed.
We provide a reference architecture, an RFP/evaluation checklist, deployment and network diagrams, a compliance mapping, and a security questionnaire response. We can also join a security architecture review with your team.
Yes. The complete platform — orchestration, routing, retrieval, and models — can run with no outbound internet access. Updates and models are delivered through a controlled offline artifact process suited to defense, government, and OT networks.
We will walk your architects, security, and compliance leads through the deployment model, data flow, controls, and compliance mapping for your environment — and answer your security questionnaire against a concrete reference architecture.