Everything people ask before going private.

AI models, document search, and workflow tools running on infrastructure you control — your own hardware, your own network, or your own cloud account — instead of a public AI service. Your documents are indexed where they live, and access is limited to named users on a private network.

Not always. Some workflows run well on CPU or a single workstation-class GPU. The assessment sizes hardware to the actual workload — not every deployment requires a full rack or a large GPU server.

The customer, directly and upfront. Hardware, GPUs, servers, racks, storage, networking, power, cooling, shipping, taxes, third-party software, and facility work are paid separately by the customer. BrooksFlow can recommend, configure, and manage procurement, but does not finance customer hardware.

Yes. On-premise deployment — models, document index, and access all inside your walls — is the core pattern BrooksFlow builds for organizations with strict data control requirements.

Yes. For teams that prefer cloud, workflows can be deployed inside your own cloud account, identity model, and logging environment — customer-controlled rather than vendor-hosted.

The default posture is no data egress: work runs on local or customer-controlled systems. Where a vendor-hosted service genuinely fits a lower-risk workflow, it is used only after explicit review and approval in the engagement scope.

No — not by default. Any training, fine-tuning, retention, or vendor data use must be explicitly reviewed and approved in the engagement scope. Data boundaries are defined before any workflow is built.

Yes, and many pilots should. Policy lookup, knowledge search, and drafting workflows can start with internal policies and de-identified documents before any sensitive material is touched.

No. Most engagements run with a business owner, an IT or security contact, and BrooksFlow doing the heavy lifting. Managed AI Ops exists so you don't have to build an internal AI platform team.

You get a recommendation for production rollout, further testing, redesign, or retirement of the use case. If the workflow moves forward, Managed AI Ops supports ongoing operation.

Yes. Integrations are scoped per engagement, with access boundaries defined before anything is connected. The system reads from approved sources only — and that approval is written down.

HIPAA obligations depend on the organization, data, vendors, contracts, deployment model, and workflow. BrooksFlow designs privacy-aware workflows and reviews BAA requirements before anything touches PHI, but final HIPAA determinations belong with qualified counsel and compliance leadership.

Yes, with careful scoping. Regulated workflows get defined data boundaries, human review points, and documentation designed for professional review. Final compliance determinations stay with your qualified legal, compliance, and security stakeholders.

Citations on substantive answers, retrieval evaluation against real questions, explicit uncertainty instead of confident guessing, and human review checkpoints on sensitive output. These controls reduce hallucination risk substantially — no honest vendor will claim to eliminate it.

Monitoring, security patching, backup verification, model and runtime management, retrieval and prompt tuning, access review support, user support and feedback triage, documentation, and quarterly roadmap work — priced by workflows, users, support cadence, and security requirements.