Rarely, and usually not well. Most engagements are co-managed: your engineers keep product and application work, and we take the platform, delivery and operational load. Where an organization has no platform team at all, we can operate everything — but we will still want a technical owner on your side.

A conversation with an engineer, then a short assessment: what you run today, what has to stay local, what breaks most often, and what you need in the next twelve months. That produces an architecture and a scoped first phase — often a single workload — rather than a platform-wide programme.

Many of them, yes: open-weight models for retrieval-augmented applications, classification, extraction and internal assistants run well on local GPU infrastructure, next to the data they need.

Some workloads still point to an external provider — where you need frontier-model capability or very large bursty training. We will tell you when that is the case, and help you design the boundary so the sensitive data stays where it must.

Least privilege by default, individual named accounts rather than shared credentials, strong authentication, secrets held in a managed store with rotation, and audit logging of administrative actions. Standing access is kept to a minimum and reviewed on a schedule.