Does any data ever leave our environment?

No. The model and RAG run on your infrastructure. In the Foundations and Sovereign tiers nothing leaves your walls except what you explicitly allow; the Government tier is fully air-gapped with zero external calls.

Are we locked to one model?

No. We deploy open-weight models and keep the architecture model-independent, so you can upgrade or swap the model as better open weights ship — without re-platforming.

What about ISO 42001 and the EU AI Act?

Governance is built into the deployment: an AI inventory entry, risk classification, a monitoring plan, and a retirement policy, structured around ISO 42001 and EU AI Act expectations. Teams that need a standalone readiness assessment can add the AI Governance add-on.

Which industries is this for?

Finance, legal, healthcare, government, and any team handling high-value or regulated data — including precious-metals and asset businesses. If sending data to a public model API is a non-starter for you, this is the offer.

Deploy · 6–12 Weeks

Private AI + RAG Deployment

Sovereign, compliant AI that never leaves your walls.

Company

Deploy from $75k

Enterprise

Sovereign & Government tiers

Timeline

6–12 weeks

What You Get

On-premise or air-gapped deployment on your infrastructure
Open-weight model, model-independent — no foundation-model lock-in
RAG over your documents with retrieval evals
SSO, role-based access, and audit-log retention
SOC 2 / HIPAA / GDPR-ready architecture and a governance package

Packages

Foundations

fixed deploy from $75,000

Private model + RAG on your infrastructure, SSO and roles.

On-prem deployment + RAG
SSO + role-based access
Retrieval evals + audit logging

Sovereign

Sovereign tier

Regulator-aligned deployment for finance, legal, healthcare.

Data-residency-aligned architecture
SOC 2 / HIPAA / GDPR-ready controls
Governance & ISO-42001-aligned documentation

Government

Government tier

Air-gapped deployment for the most sensitive environments.

Fully air-gapped, zero external calls
Hardened access + full audit retention
Compliance package + monitoring plan

In Scope

Assess & Govern

Weeks 1–3

Data inventory, sensitivity classification, access mapping
AI inventory, risk classification, and a monitoring plan (ISO-42001-aligned)
Model selection and deployment-surface decision

Deploy

Weeks 4–9

Open-weight model deployed on your infrastructure
RAG corpus indexing with retrieval evals
SSO, role-based access, and audit-log retention

Harden & Hand Over

Weeks 10–12

Security review and access hardening
Governance documentation and runbook
Knowledge transfer to your team

How It Works

A scoping call, then a Blueprint Sprint confirms residency, compliance, and a fixed deploy price.

A named senior pod deploys against a fixed timeline behind your infrastructure.

Handover with governance docs, plus a monthly governance tier under Run & Care.

What “Done” Means

A governed private AI system runs inside your infrastructure — no data leaves.

Why Codenovai

Agents are powerful and have a real security surface — prompt injection, over-broad permissions — which is exactly why regulated teams run them privately and governed. We make that the responsible default.

Fixed price

Shipped in weeks

Code + IP in your repo, day one

No lock-in

FAQ

Does any data ever leave our environment?: No. The model and RAG run on your infrastructure. In the Foundations and Sovereign tiers nothing leaves your walls except what you explicitly allow; the Government tier is fully air-gapped with zero external calls.
Are we locked to one model?: No. We deploy open-weight models and keep the architecture model-independent, so you can upgrade or swap the model as better open weights ship — without re-platforming.
What about ISO 42001 and the EU AI Act?: Governance is built into the deployment: an AI inventory entry, risk classification, a monitoring plan, and a retirement policy, structured around ISO 42001 and EU AI Act expectations. Teams that need a standalone readiness assessment can add the AI Governance add-on.
Which industries is this for?: Finance, legal, healthcare, government, and any team handling high-value or regulated data — including precious-metals and asset businesses. If sending data to a public model API is a non-starter for you, this is the offer.

Ready to start?