The situation
Compliance had blocked every AI pilot for a year. Each tool the operations team wanted — a support agent, document checks, reporting — meant sending customer data to a vendor in another jurisdiction.
So the work stayed manual. Analysts copied data between systems, and the few automations that existed ran on personal laptops with nobody watching them.
Where it broke
- 01Customer data could not leave approved infrastructure, and most AI tools required exactly that.
- 02Automations had no owner, no monitoring and no audit trail.
- 03Every vendor added a bill, a login and another place where data could leak.
What we built
A private platform on the client's own servers. Agents reach models through a gateway inside the network, workflows run in hardened containers, and every service sits behind Cloudflare Zero Trust with single sign-on.
An operations console shows health, throughput, latency and cost in one place, and every automated action is written to an audit log the compliance team can query. Nothing runs that nobody can see.
- RequestsWhatsApp, internal tools and APIs
- Model gatewayModels run inside the client's network
- Workflow enginen8n and queues in hardened containers
- Ops consoleHealth, cost and an audit trail in one view
How we rolled it out
- Days 1–4Architecture and threat model agreed with security and compliance before any code was written.
- Days 5–12Platform built: container cluster, model gateway, workflow engine, access control and logging.
- Days 13–17First three workflows moved off laptops and SaaS tools, tested against real cases.
- Days 18–21Penetration test, runbooks and hand-over; the internal team now ships the next workflows itself.
What changed
AI pilots that had been blocked for a year went live in a month. The operations team ships new automations weekly, compliance can audit every action, and three SaaS subscriptions were cancelled.
AI work that compliance had blocked for a year now ships every week — and customer data never leaves.
Representative outcomes from comparable engagements.
What we'd tell another team
In a regulated business, the fastest path to AI is not a better vendor — it is infrastructure you control. Once data never leaves, every other conversation gets easier.
