Guide

On-premises, sovereign cloud or a disconnected network: where should your AI run?

Start with one question: where may your data be processed? If it may go to a cloud region you choose, a sovereign cloud is the fastest start. If it must stay in your own cloud account, use a private cloud; if it must stay on your own hardware, use your data centre; and if nothing may leave the building, use a disconnected network with open models on your own GPUs. With Liba, every capability is available in all four, so the choice is about where the software runs, not what it can do.

What are the four options?

Sovereign cloud

Hosted in the region you choose and run by Liba. The fastest way to a production workflow, with data residency in that region and a documented processing register.

Private cloud (VPC)

Inside your own cloud tenancy: your account, your network boundary, your security controls, our software.

Your own data centre

On your hardware, under your operational control.

Disconnected network

No external connection at all. Open models run on your own GPUs, so no call to a model ever leaves the building.

Which questions decide it?

• Where may the data be processed? If your rules name a country or region, every option that keeps the data there is open to you. If they forbid any third party from hosting it, the choice narrows to your own cloud account or your own hardware.
• May anything leave the building? Some organisations cannot allow any external connection, including calls to an AI model. That points to a disconnected network.
• Who will run the servers? In a sovereign cloud, Liba runs the environment. In your own cloud account or data centre, your team keeps operational control, and with it the work of running the infrastructure.
• What does your security team already govern? If you already run a cloud tenancy with its own controls, a private cloud deployment puts the workflow inside a boundary your security team knows.
• Do you have GPUs? On a disconnected network, open models run on your own GPUs. Capacity and model choice depend on the hardware you have or plan to buy.
• How soon do you need the first workflow? A sovereign cloud is the fastest way to production. Installing inside your own environment adds the time it takes to approve and connect it on your side.

Do you lose features in a stricter option?

No. There is no governance feature, connector class or evaluation tool that exists only in Liba’s hosted environment. An installation on a disconnected network is the full product. What changes is who operates the infrastructure and, on a disconnected network, which models you run.

What stays the same in every option?

• Your data is not used to train any model, ours or a vendor’s. That is written into the contract.
• Encryption: AES 256 at rest and TLS 1.3 in transit.
• Single sign-on (SAML), provisioning from your directory (SCIM), enforced multi-factor authentication and access by role.
• Development, staging and production are kept separate. Every save is a version, and publishing to production requires approval.
• Every step is saved, so you can always check what happened and why.

For the details, see security and governance and deployment options.

How long does it take?

It depends on the process, how many systems it touches and how quickly connections can be approved on your side. We give an estimate after mapping and fix it in the scope document. First processes are planned at roughly five to nine weeks including adoption.

Limits

This guide helps you choose a direction. The binding requirements come from your security, legal and procurement teams. Our controls are designed with ISO 27001, SOC 2, the GDPR and the data protection rules of your jurisdiction in mind. Designing against a framework is not the same as holding a certification, so ask us for the current status of anything your procurement requires.