Private Deployment: Data Inside Perimeter

The short version: data sovereignty is an architecture choice, not a firewall slogan. Rust implementation, file-based storage, and fully local inference (OCR / layout / table all run local ONNX) together let a RAG data pipeline run on a single private machine—sensitive documents never leave it from parsing to chunking.

1. Why fully local inference is mandatory

Start with a common failure pattern: many RAG stacks wrap OCR, layout analysis, and table recognition behind cloud APIs, so one request ships the document image and text out of the perimeter. For finance, government, and healthcare, control is lost before data reaches the vector store—no downstream permission filter fixes that. Document preprocessing accounts for roughly 40%–50% of enterprise RAG engineering effort, and it handles the rawest, most sensitive content.

Private deployment pushes all of these models onto the machine: layout.onnx and tsr.onnx for layout and table structure, PP-OCRv6 for OCR, PDFium for rendering, all on a local ONNX runtime with zero external calls. Going local does not cost usability—a text PDF parses in under 200 ms. Where the models run is where the data stays; that is the first boundary of sovereignty.

2. File-based storage lowers delivery cost

Local inference is only step one; the storage layer decides whether a private rollout lands. FileChunkStore keeps the knowledge base as plain files with no heavy database dependency. Backup is a file copy. Migration is moving a directory. A disaster-recovery drill takes an afternoon, with no DBA and no extra database instance to install and patch inside the customer network.

The security gain matters just as much. Every external database adds an exposed port, an upgrade burden, and another attack chain. File-based storage collapses the surface to the filesystem itself, pairs with OS-level permissions, and clears compliance reviews faster. In intranets that forbid extra components, it is often the precondition for deploying at all.

3. Enterprise control plane

Keeping data inside settles the external boundary; the internal one needs multi-tenancy, auth, licensing, and audit. Multi-tenant API Key auth with quota plans isolates departments and projects and meters them separately. The machine-code licensing subsystem uses RSA hardware binding plus anti-debug, so a copied license will not boot elsewhere—protecting the vendor in private deliveries.

Audit logs and an admin console close the compliance loop: who ingested which batch, who issued which query, which Key burned how much quota—all traceable. When an external audit or internal review asks for evidence, the records are already there.

4. Relation to delivery forms

Private deployment does not lock you into one delivery form. The same capability ships as CLI, HTTP service, FFI library, or Python SDK: batch jobs take the CLI, online services take HTTP, product embedding takes FFI. In every form, inference and storage stay inside the customer environment—the sovereignty boundary does not move with the form.

Delivery details in Three Delivery Forms; the desensitization and permission baseline before embedding in Desensitization Before Embedding. When evaluating vendors, put two items on the acceptance list: does any parsing step call an external model service, and does the storage layer require a heavy database?

Decision Guide: 5 Checks for Genuine Private Deployment

• Is inference fully local: OCR, layout analysis, and table recognition all run as local ONNX models (layout.onnx + tsr.onnx). One cloud API call anywhere means data does leave your domain.
• Is storage database-free: file-based FileChunkStore without heavy database dependencies keeps private delivery and backup manageable.
• Is the process protected: all FFI entry points (rust_ingest_document / rust_resume_ingest and other C APIs) are catch_unwind guarded, so embedded integration never crashes the host process.
• Is licensing tamper-resistant: a machine-code licensing subsystem with RSA hardware binding and anti-debugging is what makes commercial delivery enforceable.
• Is multi-tenancy isolated: API Key authentication, plan quotas, and audit logs are prerequisites for serving multiple departments or customers from one deployment.

Rust implementation, file-based storage, and single-machine deployment form the hard threshold for regulated industries (finance / healthcare / government); AI product integrators care more about embedding via FFI or HTTP. Delivery options are compared in RAG Delivery Forms, and the permission-side design in RAG Permission Tagging.

FAQ

Q1: How is data sovereignty guaranteed?

By architecture, not by slogan: a Rust implementation, file-based storage, and fully local inference (OCR, layout, and table models all run as local ONNX). From parsing to chunking no external service is called, so sensitive documents never need to leave the machine.

Q2: Why file-based storage?

FileChunkStore has no heavy database dependency: backup is a file copy, migration is moving a directory, and disaster-recovery drills take an afternoon. Skipping the external database also shrinks the attack surface and makes customer compliance reviews easier to pass.

Q3: How are multi-tenancy and licensing handled?

Multi-tenant API Key auth with quota plans isolates departments and meters usage separately. Licensing uses machine codes with RSA hardware binding plus anti-debug, and audit logs with an admin console provide the traceability that security reviews ask for.

Q4: Is single-machine performance enough?

Yes. Rust plus a local ONNX runtime runs the full parse-chunk-retrieve chain on a single machine, and a text PDF still parses in under 200 ms. That fits finance, healthcare, and government deployments where data sovereignty is a hard requirement, without sacrificing ingestion throughput.