Grounded AI where the data cannot leave

Summary

Defence, government, healthcare, financial services and critical infrastructure hold the estates that would benefit most from a capable assistant, and are the ones most often told to wait. Their data cannot be sent to a hosted model, cannot be indexed in a vendor's cloud, and in some cases sits on a network with no route to the internet at all.

The answer is not a diminished experience. It is an architecture in which every stage that touches file content, from crawling and extraction to retrieval and answering, runs on infrastructure the organisation controls, with no dependence on an external service for licensing, updates or telemetry. KDBL Context Lake (K-Lake) was designed for that constraint. This paper walks through each stage of a grounded-AI pipeline, shows where data would ordinarily leave, and describes how K-Lake keeps it inside.

What "private" has to mean

Almost every vendor now describes their offering as private. The word has come to mean anything from "we do not train on your data" to "your tenant has its own encryption key". For a regulated organisation, none of those is the question. The question is whether file content, or anything derived from it, crosses the organisation's boundary at any stage, for any reason, including reasons that have nothing to do with AI.

Read that way, "private" has four tests:

• Content. Does the text of a file, or an image of a page, or the audio of a recording, ever leave the boundary to be read, indexed, embedded or summarised?
• Derived data. Do embeddings, extracted text, entity names or search indexes, which are the content in another form, leave the boundary to be stored or queried?
• Metadata and telemetry. Do file names, paths, user identities, query text or usage statistics leave the boundary as telemetry, licensing checks or support diagnostics?
• Operation. Does the system continue to work if the boundary is closed entirely: no licence server, no update server, no model API?

A product is private for this audience only if the answer to all four is no, or is under the organisation's explicit control.

Where data moves in an AI pipeline

A grounded assistant over files has five stages. Each is a place where a conventional design sends data out.

Stage	Where data usually leaves
Crawl	A SaaS connector reads the share from the vendor's cloud, so listings and permissions cross the boundary before anything else does.
Extract	OCR, document parsing and transcription are sent to a hosted service, page by page. This is the most complete exposure of content in the pipeline.
Index and embed	Extracted text is embedded by a hosted model and stored in a hosted vector database. The index is the content in a form that can be searched.
Retrieve and answer	The query and the retrieved passages are sent to a hosted model, together with the user's identity for attribution.
Operate	Licence validation, usage telemetry and diagnostics phone home on a schedule, carrying whatever the vendor chose to include.

Each stage can be defended on its own. Together they mean the organisation's most sensitive files are read, transformed and stored by systems it does not run, under terms it does not control.

Keeping every stage inside

K-Lake runs as a small set of services in the customer's own Kubernetes cluster. Each stage stays inside the boundary by design rather than by configuration.

Crawl

Workers run in the cluster and read sources read-only, over S3, Azure Blob, SMB, NFS and Microsoft Graph. Listings, permissions and file records are written to a database in the cluster. The work queue holds only task references, never content or credentials.

Extract

Extraction is self-hosted. A fast default engine handles the bulk of a corpus; a document engine handles scanned PDFs, OCR and structured tables; an optional vision-model engine handles the hardest layouts on GPU; a media engine transcribes audio and video with timecodes. All run as a scale-out fleet inside the cluster. If a customer deliberately configures an external extraction provider for some files, each send is recorded in the audit trail with the file, the provider and the bytes sent, so the exception is visible rather than silent.

Index and embed

Extracted text, embeddings for semantic search, entities and the audit trail are stored in the managed database in the cluster. Semantic search uses an embedding service that runs inside the cluster. Nothing derived from content is stored anywhere else.

Retrieve and answer

K-Lake exposes its content to assistants over the Model Context Protocol. Which model answers is the customer's choice. A hosted assistant such as Claude can connect where policy allows; where it does not, a self-hosted model on the customer's own hardware connects to the same MCP endpoint with the same per-file trimming and the same audit trail. The MCP server serves extracted text and metadata, never original file bytes, and each user's assistant sees only what that user could open.

Operate

Licensing is enforced offline. A licence is a small, cryptographically signed document carrying the customer, the capacity and the expiry. Every service can verify it locally and none can alter it; there is no licence-server call-home. The product does not send telemetry. Metrics and structured logs are emitted in standard formats to the customer's own monitoring stack. Diagnostic packs for support are generated locally and shared only if the customer chooses to.

Fully air-gapped operation

For networks with no internet egress at all, K-Lake runs end to end with nothing outside the boundary. The images are brought in through the customer's controlled transfer process. Extraction engines and the embedding service run on local nodes. A self-hosted language model runs on local GPU hardware and connects over MCP, authenticating with a personal access token so that no identity provider round-trip is needed. Licence validation is local. The result is a grounded, cited assistant over the estate with zero egress, and a demonstration guide in the documentation walks through exactly that configuration.

Air-gapped sites are not a special edition. The same product, the same policies and the same audit trail apply, so a decision made about K-Lake for a connected environment carries over to the disconnected one.

Residency, licensing and support

Because K-Lake is self-hosted, KDBL does not process or receive the customer's indexed data. Content and metadata remain within the customer's data-residency boundary throughout. KDBL is registered with the UK Information Commissioner's Office.

Licences are issued by KDBL, sized by source-file capacity and term, and applied once with a single command. Renewing or resizing means applying a new licence, with no reinstall and no connectivity. Enforcement is fail-closed and staged, with a grace window before lockdown, so an expiring licence is visible long before it matters. Deployments through the Azure Marketplace derive entitlement from the plan instead.

Release images are cryptographically signed, and a rolling daily security report publishes vulnerability findings across every shipped image, so a customer's own scanning can be compared against the vendor's before an image is admitted through a controlled transfer.

Questions for any vendor

Whether evaluating K-Lake or an alternative, these questions separate private from "private".

1. At which stage does file content, or a page image, or audio, leave our boundary, and to whom?
2. Where are extracted text and embeddings stored, and who operates that store?
3. Which model answers the question, where does it run, and can we substitute one we host?
4. What does the product send home: licence checks, telemetry, diagnostics? Show us the payload.
5. If we close the boundary entirely, what stops working?
6. When an exception is made, for example an external OCR service for one document type, is the exception recorded per file?
7. How do we verify the images we are admitting, and how often are they scanned?

K-Lake's answers are in this paper and in the security overview maintained in the product documentation. We are happy to be asked the questions again in a review session.