Your AI Governance Data Is Sensitive Data. Here’s How Olakai Runs Inside Your Walls.

Think about what an AI governance platform actually collects. Every prompt an employee typed into ChatGPT. The contract an analyst pasted into Claude for a summary. The customer list someone dropped into a spreadsheet copilot. Which department exposed patient data last Tuesday, and who in that department did it. Cyberhaven Labs‘ 2026 AI Adoption & Risk Report found that 39.7% of AI interactions expose sensitive data, and that the average employee sends sensitive information into an AI tool roughly once every three days. A platform that watches all of that is not a dashboard. It is the most complete inventory of confidential material your company has ever assembled in one place.

So here is the question security teams started asking us in 2025, and have not stopped asking: where does that inventory live? If the answer is “in the vendor’s multi-tenant cloud,” you have addressed shadow AI by creating a second copy of everything shadow AI exposed, outside your perimeter, under someone else’s retention policy. That is not a hypothetical worry. Samsung banned generative AI tools for staff in May 2023 after engineers pasted source code and chip yield data into ChatGPT, and JPMorgan, Goldman Sachs and Apple restricted them the same spring. Companies that learned that lesson about AI tools will not unlearn it for the tool that monitors the AI tools.

The market has already moved

The infrastructure data points the same direction. In a February 2026 survey of 203 enterprise IT decision-makers commissioned by Cloudian, 91% said they would choose on-premises, private cloud or hybrid infrastructure over public cloud for AI that touches sensitive company data. Fifty-eight percent said data-residency concerns had directly delayed or scaled back an AI initiative, and 74% rated shadow AI a critical or significant security concern. Broadcom’s Private Cloud Outlook 2026, with a larger sample of 1,800 senior IT leaders across three continents, found that public cloud’s share of production AI inference fell from 56% to 41% in a single year. And Gartner forecasts sovereign cloud infrastructure spending of $80 billion in 2026, up 35.6% in a year.

Two of those three are vendor-commissioned surveys, so treat the exact percentages with caution. The direction is not in doubt, and it matches what we hear in every regulated-industry conversation: the buyer has already decided that the model, the data and the governance layer will all sit inside their boundary. The only open question is which vendors can meet them there. That buyer is who Olakai Enterprise was built for.

Regulated industries do not get a vote

For some of our customers, on-prem is not a preference to be weighed against convenience. A bank operating under SR 11-7 and data-residency mandates cannot send AI interaction logs through a third-party cloud to govern its AI. A health system cannot route clinical notes containing PHI through a vendor’s servers to find out whether a clinician pasted them into a chatbot. A law firm’s client confidentiality obligations do not carve out an exception for the compliance tooling. A manufacturer’s OT environment under IEC 62443 is not connected to the internet at all. In each case the SaaS answer ends the procurement conversation, and since the EU AI Act’s high-risk obligations became enforceable on August 2, 2026, with a six-month minimum on event logs and penalties up to 7% of global revenue, European buyers have one more reason to want those logs on infrastructure they control.

We see this in our own search traffic. One query that landed on our healthcare page this quarter read, almost word for word: every AI vendor we shortlist wants a copy of our claims data, so which platforms deploy into our own environment and leave the data where it is? That sentence is the entire brief.

How Olakai on-prem actually works

Olakai on-prem is the full platform, not a thin agent that phones home for the real work. Our install guide describes it plainly: the bundle “runs the entire platform — app, database, object storage, queue, and background jobs — on a single Linux VM via Docker Compose.” A one-command installer exchanges your license key for a signed bundle, verifies the signature before anything is extracted, generates every secret, brings the stack up behind an automatic HTTPS reverse proxy, and emails your first administrator a magic link to set a password. The guide’s own estimate is that “a complete install takes about 3–5 minutes once your DNS record and ports are in place.” The VM can live in your data center or in your own AWS, Azure or GCP account; Ubuntu, Debian, RHEL, Oracle Linux and Amazon Linux are supported, on Docker or rootless Podman.

Sizing is driven by how many people and coding agents you monitor and how long you keep the data, not by raw compute. The bundle ships its own Postgres, Redis and object store, and you can point it at managed instances you already run instead.

Where the analysis runs is your call

This is the part security reviewers care about most. Olakai reads each captured interaction with a language model to detect sensitive content, classify it and score it. On SaaS, Olakai’s hosted models do that. On-prem, you decide where the model runs, and you decide it separately for each kind of analysis: sensitive-content detection, classification, advanced analytics and session scoring are routed independently. You can point any of them at Anthropic, OpenAI or Google under your own API key, in which case the prompt text goes to that provider over an encrypted connection and, as the docs put it, “Olakai is not in the path and never receives the content.” Or you can point them at an OpenAI-compatible inference server inside your own network, running vLLM or Ollama, where the answer to “what leaves your network” is a single word: nothing. A fallback never crosses the boundary you set: if your in-network model is unavailable, Olakai waits rather than quietly sending the content to a cloud provider.

The pattern we see most from regulated customers is a split: keep sensitive-content detection and classification in-network, because that is where regulated text is actually read, and leave the heavier analytics and session scoring with a provider, because that is where frontier model quality is worth the most. If you have been running the build-or-buy arithmetic on hosting your own model, this is where it pays off: a 30-billion-parameter open model is more than enough to tell a social security number from a sprint retro.

Beyond the model you choose, the deployment does not talk to Olakai’s product infrastructure. The network allowlist states that app.olakai.ai and Olakai’s own product hosts “are never contacted from an on-prem deployment. There is no Stripe, Google Analytics or PostHog traffic.” Fully air-gapped installs are supported by mirroring the images to an internal registry and carrying the bundle across by hand. Everything else is the same product: both Olakai Assistive and Olakai Agentic, the integrations, OIDC single sign-on with Okta, Entra ID or Google Workspace, retention windows from 14 days to forever, and the control that makes a second administrator approve any viewing of prompt content, with every view logged. On-prem deployments also carry no usage limits.

This is about more than a compliance checkbox

It is tempting to file on-prem under “things regulated industries make us do.” That undersells it. Olakai’s whole premise is to be the vendor-neutral system of record for the entire AI stack: the one place where ChatGPT usage, Copilot seats, Claude Code spend and autonomous agent runs are measured against the same business outcomes and governed under the same policies. A system of record for your AI program is, by definition, the richest dataset about how your company works that has ever existed, and treating its location as an afterthought would contradict everything the product stands for. To our knowledge, Olakai is the only platform that combines AI ROI measurement with governance and will run entirely inside the customer’s boundary; most tools in this category are SaaS-only, and the ones that do self-host stop at compliance checklists.

For a CISO, that means shadow AI discovery, policy enforcement and the audit trail live on infrastructure the security team already controls, with no new subprocessor on the data map. For a CFO, it means the ROI and spend numbers the board asks for come from a system finance can trust precisely because the data never had to leave to be analyzed. The shadow AI statistics are not getting better on their own, and the regulatory calendar is not getting lighter. The choice is between measuring and governing AI from inside your walls now, or explaining later why the tool meant to stop data leaving the building was itself sending data out of the building.

Getting started

Most teams begin on SaaS, where the Starter tier is free; it runs on AWS with a completed SOC 2 Type II examination covering the Security criteria, with the report available under NDA. When a security policy, a regulator or a customer contract says the governance layer has to sit inside your perimeter, Olakai Enterprise adds the on-prem bundle with custom SLAs and dedicated support, and our team walks your infrastructure group through the install and the model-routing decisions before anything is provisioned. The short version of the deployment options is summarized here; the long version is a conversation.

Ready to see Olakai running where your data already lives? Talk to an expert about an on-prem deployment.