The challenge behind the engagement.
This service is for teams that must run a model where the data lives: on premises, in a private cloud, or fully offline, for CUI, ITAR or EAR data, PHI, code, or trade secrets. We classify the data and name the rules that govern each class. Then we design safe model intake: approved publishers only, unsafe file formats blocked, and every model checked against its published fingerprint before it loads. A trusted internal library keeps your hosts off the public internet. We harden the model server behind a strict gateway, isolate the GPU hosts with patched software, limited privileges, and separation between tenants, and split the management, serving, storage, and outbound networks apart. You receive a reference architecture, build snippets, and per-control validation evidence; your administrators apply every change.
For defense contractors, exporters, healthcare providers, and software companies that cannot send prompts to a hosted model, and for the platform teams asked to stand one up. Engage when procurement has picked the GPUs, before the first model is pulled from a public hub, or when an existing deployment must fit inside a CUI boundary.
What we do.
What you can use.
Classify data and inventory the stack
We start with your data classification and any existing controlled-data boundary diagram, the GPU, platform, and storage inventory, the models and licenses you intend to run, and the administrators who hold write access. We then name the rules that govern each data class: the defense contractor requirements for CUI, the export rules for ITAR and EAR data, or the health-data privacy rules.
Harden weights, servers, and GPU hosts
We design model intake and verification, then harden the serving layer: the model server behind a strict gateway, run with the lowest privileges, remote management turned off, and encrypted internal connections. We isolate the hosts with patched software, no privileged containers, hardware partitioning or dedicated hosts per tenant, and confidential computing where your threat model needs it.
Validate each control with evidence
You receive the reference architecture, the model intake procedure with its verification records, the automation snippets your team applies, the GPU host checklist, the segmentation and access design, and a mapping of every control to the defense, health-data, and export requirements. After the build we confirm each control with command output or screenshots and file the evidence for your compliance package.
Who it’s for.
When you need it.
- Defense contractors and exporters barred from sending prompts or technical data to hosted models
- Healthcare or research teams running inference on PHI or proprietary datasets in house
- Software firms whose models, weights, or code are the product they protect
- Platform teams standing up on-premises, private-cloud, or air-gapped GPU inference
- Procurement has picked the GPUs and the serving stack must be designed
- A model is about to be pulled from a public hub for the first time
- An existing self-hosted deployment must fit inside a CUI or export boundary
- A contract or auditor requires evidence that weights and hosts are controlled
What the scope can include.
- 01
Data classification per workload and the rules that govern it: defense contractor, export-control, or health-data requirements
- 02
Model intake: approved publishers only, unsafe file formats blocked, fingerprint and signature verification before load, and a registry that records provenance
- 03
Model server hardening: a strict gateway allowlist, scoped authentication, lowest-privilege service, unused interfaces turned off, and encrypted internal traffic
- 04
GPU host isolation: container runtime and GPU operator patch levels, non-privileged containers, hardware partitioning or dedicated hosts, confidential computing with attestation when required
- 05
Segmentation and access: separate management, inference, storage, and egress networks, identity-aware gateway, single sign-on or per-team credentials, vaulted secrets, jump hosts
- 06
Air-gapped operation: offline repositories, media transfer procedure, signed out-of-band updates, and a log export path
What it typically costs.
One rate: $150/hour.
Every engagement is priced by the hours it takes at one flat rate, with scoping, the work, and the final deliverables included. Find the size closest to yours.
One model running on a few in-house servers for a single team
About 48–72 hoursSeveral models on a shared server cluster used by multiple teams, inside a controlled-data boundary
About 96–150 hoursA fully offline or multi-site deployment serving many teams, with a complete compliance evidence package
About 180–260 hours- Number of models and server hosts in scope
- Whether the environment is fully offline, which adds update and transfer procedures
- How many teams or customers share the hardware
- Which rules apply (defense, export-control, or health data rules) and how much evidence is required
Ranges are planning estimates at $150/hour, not a quote. Your price is confirmed in writing after a scoping call, before any work begins.
What you take forward.
- Hardened reference architecture with network diagram and the model intake and verification procedure, including signature and hash records
- Build documents and automation snippets your administrators apply, plus the GPU host hardening checklist
- Logging and retention design covering prompt redaction, host and container telemetry, and alerts on model file changes
- Control mapping to the defense, health-data, and export requirements, with a validation report showing command output or screenshots per control
Final coverage, deliverables, timing, and any retesting or implementation work are confirmed before the engagement begins.
Before we get started.
Can we use open-weight models from public hubs for CUI or ITAR work, and how do we prove the weights are untampered?
You can, if intake is controlled. We restrict downloads to a trusted internal library so your hosts never touch the public internet. We accept only safe file formats from publishers you approved and block the formats that can run hidden code. Before a model enters your registry we record its fingerprint and, where the publisher signs, its signature; those records become evidence for your compliance package. Licensing is your counsel's call; we flag terms that restrict use but do not interpret them. For ITAR and EAR data stored in a cloud, we design key handling so the provider cannot decrypt it, which is the condition the export rules set for storage not to count as an export.
Does self-hosting make us CMMC compliant?
No. Self-hosting removes the external cloud provider from your boundary, and with it the FedRAMP-equivalent standard a defense contract demands of such a provider. CMMC status still comes only from the assessment your contract requires. DoD suspended Phase 2, the step that would make an independent Level 2 assessment an award condition, on July 13, 2026 pending a review; Phase 1 self-assessments and affirmations remain in force. Our design and build work maps each control to the requirements your contract names and produces the evidence an assessor will ask for. Because the principal is a CMMC Certified Assessor, the firm cannot later assess an organization it helped prepare.
- Secure Software Development Practices for Generative AI and Dual-Use Foundation Models: An SSDF Community Profile (NIST SP 800-218A)
- AI Risk Management Framework
- Joint Guidance on Deploying AI Systems Securely
- AI Data Security: Best Practices for Securing Data Used to Train & Operate AI Systems
- OWASP Top 10 for Agentic Applications for 2026
- Model Context Protocol Specification: Authorization
- Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations (NIST SP 800-171 Rev. 3)