Your data never trains a model. Not theirs, not ours.
The hub runs inside your own cloud, under your keys. The only thing that ever leaves is a model request, and no one keeps it to train on.
At every stage, nothing leaves.
The only thing that ever crosses your perimeter is a single model request. Your data, keys, and logs never do. Here is the guarantee at each stage.
Your data trains no model, ever.
Your prompts and outputs train no model, the provider's or ours, and nothing is stored, not even briefly.
Your cloud, or your own servers.
Runs in your own cloud account or on your own servers, all the way to fully air-gapped. We don't run your infrastructure, and we don't copy your data out of it.
Read-only by default.
Every connector reads. Writes are granted agent by agent, and anything that acts on your systems routes through a human approval step first.
Yours, never ours.
Credentials stay in your own secret store. Engineer access on our side is named, time-bound, MFA-protected, and revoked at handover.
Logged end to end.
Every agent action and every engineer action lands in your own logging stack. Access is role-based and scoped per user.
Yours to keep. No lock-in.
At handover the hub, the logic, and the runbooks are yours. It keeps running if we walk away, and one command removes our access for good.
Agent outputs are reviewed by a person before any decision that carries real consequences.
Your cloud, your own servers, or fully air-gapped.
The hub is software you own, not a service you rent, so it runs wherever you run software. Pick the boundary you need. The agents are the same in all three.
Your cloud
Deployed into your own AWS, GCP, or Azure account, inside your VPC. Model calls go to your AI provider on a zero-retention contract. Right for most teams.
One zero-retention model request leaves your perimeter.
Your own servers
The same hub, installed in your data center or private servers. Nothing in it assumes a public cloud. If your team can run Python, it runs there.
One zero-retention model request leaves your network.
Fully disconnected
On-prem, plus a model you host yourself inside your network. Nothing crosses the boundary. Zero external dependency.
Nothing leaves your network. At all.
The runtime is our own code: MIT-licensed, pip-installable, not hosted SaaS. That is why we can meet any of these boundaries without re-architecting. Air-gapped mode swaps the frontier model for one you host, and we help you weigh that trade-off.
The runtime is open source.
The hubzoid package is MIT-licensed and public: your team can read every line that runs against your data. What you audit is what ships.