# Private Model Hosting Private hosting serves a model on capacity dedicated to one organization, with its data, its prompts, and often its own fine-tuned weights kept within a boundary that organization can describe to its regulator. It is the arrangement through which hospitals, banks, agencies, laboratories, and manufacturers actually adopt this technology. > [!note] The one-sentence version > The model runs on hardware reserved for one organization, inside a boundary that organization can point to in an audit. ## Why it exists Many institutions hold data they may not send to a shared service: patient records, financial detail, classified or controlled information, trade secrets, or material governed by residency requirements. Their choice is therefore between forgoing the capability and obtaining it inside an acceptable boundary. Private hosting supplies the second option, and in doing so it determines how widely this technology reaches the parts of the economy that handle consequential information. ## The forms, from least to most isolated **Dedicated endpoint on shared infrastructure.** Reserved capacity in a provider's facility, with the tenant's traffic served by workers that run nothing else; predictable performance and a contractual boundary; see [[wiki/Inference Endpoint|Inference Endpoint]]. **Dedicated hardware.** Physical machines assigned to the tenant, with the provisioning and isolation that implies; see [[wiki/Bare Metal Compute|Bare Metal Compute]]. **Hardware-enforced confidentiality.** Encrypted accelerator and system memory with attestation, so the operator cannot read the workload even with physical access; this is what permits a strong claim rather than a contractual one; see [[wiki/Confidential Computing|Confidential Computing]]. **Tenant-premises deployment.** The provider's platform operated inside the customer's own facility, under the customer's physical control, which is the arrangement most often required by national and defense institutions; see [[wiki/Sovereign AI|Sovereign AI]]. **Disconnected operation.** A deployment with no external connectivity, updated by controlled media, for the most restricted environments. ## What such institutions actually require The technical isolation is necessary and rarely sufficient. The requirements that decide a procurement are usually these: a documented data boundary, with a statement of what leaves and what does not; a commitment that prompts and outputs are not retained or used for training; audit logging sufficient for the institution's own compliance obligations; data residency in a named jurisdiction; the ability to serve the institution's own fine-tuned weights without those weights leaving its control; retrieval grounded in the institution's corpus rather than in general web material; see [[wiki/Retrieval-Augmented Generation|Retrieval-Augmented Generation]]; and policy controls over autonomous agent behavior, including what tools an agent may call and what limits apply. Those are ordinary, answerable requirements, and the fact that they are now routinely met is why this capability is moving into American institutions rather than remaining with the firms that built it. ## Relationships - **delivered through:** [[wiki/Inference Endpoint|Inference Endpoint]] · [[wiki/Inference Serving|Inference Serving]] · [[wiki/Bare Metal Compute|Bare Metal Compute]] - **protected by:** [[wiki/Confidential Computing|Confidential Computing]] · [[wiki/Data Center Security|Data Center Security]] · [[wiki/Supply Chain Security|Supply Chain Security]] - **grounded by:** [[wiki/Retrieval-Augmented Generation|Retrieval-Augmented Generation]] - **extends to:** [[wiki/Sovereign AI|Sovereign AI]] - **part of:** [[wiki/Intelligence Delivery|Intelligence Delivery]] - **source articles:** [[articles/Vertically Integrating an AI Superpower from AI Factory to Citizen|Vertically Integrating an AI Superpower from AI Factory to Citizen]] · [[articles/The Gigawatt Is the New Measure of War|The Gigawatt Is the New Measure of War]] - **collection route:** [[collections/American Infrastructure|American Infrastructure]] · [[collections/American|American Collection]] ## Evidence posture - **Established:** the isolation forms from dedicated endpoints through dedicated hardware, hardware-enforced confidentiality, tenant-premises deployment, and disconnected operation; the institutional requirement set covering data boundaries, retention and training commitments, audit logging, residency, tenant-controlled fine-tuned weights, corpus-grounded retrieval, and agent policy controls. - **Established (datestamped):** as of October 2026, managed platforms in the industry offer private retrieval-grounded deployments, endpoint management, usage controls, and agent policy enforcement to enterprise, regulated, research, and public-sector customers. ## Sources - Managed inference service documentation and regulated-sector deployment practice, as current October 2026.