Private Deployment Is Not Default: When Data Classification Justifies It

“Private” for a custom AI Agent means inference (and optionally weights) run inside a boundary you control, with knowledge, logs, and gateways governed the same way—not “custom therefore local GPUs,” and not “a Chinese-language model keeps data in-country.” Most pilots should start with data classification plus API or private cloud; add on-prem inference when residency or security baselines are written. Shapes and cost: /blog/deepseek-private-deployment-guide. GeonAI picks the gateway from your compliance outcome; /agents are capability references only (not a public trial of 363+ presets). Email [email protected].

Why custom ≠ private by default

• Custom delivery covers scenario, boundaries, knowledge, tools, and acceptance—not rack location
• With no residency clause, private clusters mainly add idle GPU and on-call cost; they do not automatically raise answer quality
• Ungoverned knowledge and missing ACL still leak or go stale on a private cluster
• Thin ops staff makes patching and recovery slower than a public API

Decision order

1. Classify data: public / internal / confidential / restricted (what may enter prompts and logs)
2. Decide whether inference must stay inside your boundary (written clause, not a “safer” feeling)
3. Govern knowledge and logs on the same boundary (private store + egress prompts is incomplete residency)
4. Check ops capacity (upgrades, CVEs, on-call, rollback)

Sample classification table

One Agent can mix lanes: public FAQ on the cloud, confidential traffic on private inference. Permissions and citations still need RAG/ACL: /blog/enterprise-rag-knowledge-base-agent. Integration and gray-release cost: /blog/custom-agent-quote-underestimated-costs. After classification, add audit logs and internal access controls: /blog/enterprise-ai-compliance-overview.

Signals you should not private-first

• Legal/security has no written residency scope (prompts, docs, logs, vectors)
• No GPU/inference platform and no on-call SRE
• KB ungoverned: no Owner, no versions, no expiry (release/rollback: /blog/custom-agent-knowledge-release-rollback)
• Pilot KPIs and boundary tables unsigned—govern first, buy cards later

Knowledge Owner and gate sign-off: /blog/custom-agent-project-owner-raci. Do / don’t / human-confirm tables: /blog/custom-agent-scope-boundary-in-contract.

How to brief GeonAI

Say whether residency or a security baseline is written, which cloud and ops staff you have, and which data class enters prompts. Email [email protected], /pricing, or Live chat. Private-deploy plans on /pricing need assessment—no one-price bundle.