◆ Sanctioned AI · Behind your firewall
The AI your compliance team finally signs off on.
Loc.ai runs entirely on your own servers and devices. The same OpenAI-compatible API your engineers already know — but nothing ever leaves your environment. On-prem, private cloud, or fully air-gapped. Deployed in weeks, not months.
Deployment
On-prem · air-gapped
Time to deploy
5–10 weeks
Data egress
Zero. Ever.
API
OpenAI-compatible
◆ The problem
Your firm is already using AI. You just don't get to see it.
While you're drafting the AI policy, your analysts are pasting client decks into ChatGPT. Banning it doesn't stop it — it just makes it untraceable.
71%
of workers use unapproved AI at work
Microsoft Work Trend Index, 2025
77%
paste data into chatbots — over half includes corporate info
LayerX, 2025
1 in 5
organisations breached via shadow AI in the last 12 months
IBM Cost of a Data Breach, 2025
+$670K
additional breach cost when shadow AI is the vector
IBM, 2025
Shadow-AI breaches take 247 days to detect — six times longer than baseline. The exposure compounds every week the policy stays in draft.
Built for how security teams work
The architecture your CISO actually approves of.
Zero external data transfer
Prompts, documents, and responses never leave your network. By architecture, not by policy.
Air-gapped deployment
Full functionality with no internet connection required. Deploy behind your firewall.
Audit trail & RBAC
Audit logging and role-based access control out of the box — sign-off your security team can actually give.
Device-first, server-flexible
Inference runs on end-user devices by default. Routes to your own servers when required — never to a third party.
◆ Build vs buy
The DIY path is 18 months and a team you don't have.
Loc.ai is a quarter and a licence.
Path A
Do nothing
Shadow AI keeps growing. Every week without a sanctioned tool is more client data flowing into ChatGPT, more untracked exposure. The board's patience for "we're evaluating" runs out.
Compounding exposure
Path B
Build it yourself
Hire ML engineers. Procure GPUs. Stand up vLLM/TGI/K8s. Build governance, audit logs, evals, model versioning, fallbacks. Then maintain it forever.
18+ months to first user
Path C · Loc.ai
A licensed platform you deploy yourself
A single binary, OpenAI-compatible endpoint, governance and audit out of the box. Runs on your hardware. Optional professional services for the first use case.
10 weeks to sanctioned AI
The only option that satisfies the auditor and ships this quarter.
| Capability | Cloud APIs | Private cloud | DIY on-prem | Loc.ai |
|---|---|---|---|---|
| Zero data egress | ✗ | ~ | ✓ | ✓ |
| Air-gapped deployment | ✗ | ✗ | ✓ | ✓ |
| Sovereign / your jurisdiction | ✗ | ~ | ✓ | ✓ |
| Audit logging & RBAC built in | ~ | ~ | ✗ | ✓ |
| Time to first sanctioned workflow | Days | Months | 12–18 mo | 5–10 wk |
Built for regulated industries
Sectors where sovereign AI isn't a preference — it's a requirement.
Financial services
FCA, PRA, MiFID II, SEC
Healthcare & life sciences
HIPAA, NHS data rules, GDPR
Legal & professional services
Privileged & confidential data
Defence & government
Air-gapped, classified environments
Critical infrastructure
Energy, telecoms, transport, utilities
CISO-restricted orgs
Where ChatGPT and Copilot are banned
◆ Proof · Meet SafeChat
A sanctioned AI workspace your firm can actually deploy.
The ChatGPT / Copilot alternative for firms that can't send a single token to the cloud — tailored to each customer's workflows, documents, and access policies.
- Tailored to each customer's workflows — not a generic chatbot
- Pre-cleared security posture, passed review at regulated buyers
- Runs on your hardware. Zero egress, full audit trail, offline-capable
The auditor sees a sealed box. The user sees ChatGPT.
Your developers already know how to use it
Loc.ai exposes an OpenAI-compatible API. Point your existing code at a new endpoint — that's the migration.
-
Drop-in OpenAI-compatible API
Same SDKs, same request and response shape. Works with what you've already built.
-
No retraining your team
If they've used the OpenAI API, they're done learning. No new framework to adopt.
-
No migration project
No rewrite, no new abstractions, no parallel stack to maintain.
◆ Deployment roadmap
Sanctioned AI in 10 weeks
From security intro to in-production internal AI.
Week 0–1
Security architecture review
Walk your security team through the data flow, audit posture, and reference architecture. Most objections cleared in one session.
Week 2–3
POC on your infra
Stand up Loc.ai:Stack on your hardware — bare metal, private cloud, or air-gapped. Validate it runs in your environment.
Week 4–6
Wedge use case live
Pick one high-value workflow with the business sponsor — document review, internal Q&A, contract extraction — and put it in front of real users.
Week 7–10
Roll out across teams
Expand to additional workflows. Production pricing kicks in. Optional professional services to design and build subsequent solutions.
SOC 2 in progress · zero external API calls · audit logging and RBAC out of the box · air-gap supported.
"When your auditor asks 'where does your AI data go?' — the answer is one word: nowhere. It stays on our servers."
— The conversation you want to have with compliance.
Bring your security lead. We'll bring the architecture.
Two ways to find out if this works for you.
Path 1 · Security review
45-min security architecture review
We walk your security team through the data flow, deployment topology, and audit posture. You leave with diagrams your compliance team can sign off.
Book a security reviewPath 2 · Scoped pilot
Pick a wedge use case. Run it.
Tell us your highest-value blocked workflow. We'll scope a 6-week paid pilot on your infrastructure — including optional services to build the first solution end-to-end.
Scope a pilotWe typically respond within one business day.