Private AI, in the open

PrivateMind is a private AI platform in the plainest sense of the word. Open-weight models running on GPUs we own, in facilities we operate. No prompt, document, or completion is ever sent to a third-party API. Each customer organization's data lives in its own database, not in a shared schema behind a tenant_id column. If you ask where the data goes, the answer fits in one sentence: it doesn't.

This blog is where we explain, in public, exactly how that works.

The tension is the point

"Private AI, in the open" reads like a contradiction. It isn't, and it's worth saying why.

What has to stay private is the data: prompts, documents, embeddings, audit trails. What doesn't have to stay private is the design. A platform whose privacy depends on nobody knowing how it's built doesn't have privacy, it has obscurity. Cryptographers settled this in 1883: assume the adversary knows the system, keep only the keys secret. We hold the architecture to the same standard. If a decision can't survive being written up, the decision should change, not the writeup.

There is also a selfish reason. Explaining a design to strangers is the cheapest review process we know. Half of these posts will exist because writing for people outside the building is the fastest way to find out whether a choice is defensible.

What we built, in four sentences

Most posts here will assume this much.

• Models are open weights, served by vLLM on GPU clusters we run ourselves. There is no fallback to an external provider; when a model misbehaves, we fix it on our own metal.
• Every model call, whether it comes from browser chat, an agent loop, embeddings, or voice, passes through one Rust gateway. A single process authenticates, authorizes, audits, bills, and rate-limits everything, and nothing gets a faster internal path that skips it.
• The tenant boundary is the database boundary. One PostgreSQL database per organization, vectors included. There is no shared store of customer content to leak.
• Everything is declared in git and reconciled continuously. A configuration change, including a security change, is a reviewed pull request, and any cluster can be rebuilt from its repository.

If it isn't running on hardware you control, it isn't private. Everything else is a marketing claim.

What you'll read here

Three kinds of posts, mostly.

• Design decisions, with the tradeoffs attached. Why each user gets one persistent gateway key instead of session tokens. Why token accounting is anchored to the end of a stream, so hanging up mid-completion doesn't erase the bill. Why tokens served from prefix cache cost the tenant nothing (they cost us almost nothing to produce, and we own the meter).
• Field notes from production. Sovereign AI in regulated environments is mostly unglamorous work: admission control, default-deny networks, migrations, GPU scheduling. When something breaks, the writeup will say what actually broke and what we changed, not "a brief service disruption".
• Announcements, when there is a thing worth announcing.

What you won't read: product fluff. No "we're thrilled to announce", no predictions about the future of AI, no claim we can't back with a design document or a graph. Where we got something wrong, the post will say so, because the wrong turns are usually the instructive part.

Where this goes

The first posts cover the gateway (why one choke point, and what it deliberately refuses to do) and the tenancy model (why a database per organization is worth the operational cost). After that, wherever the work goes.

New posts when we have something worth saying. There's an RSS feed. That's the whole funnel.