All posts
Private AI for Business: How to Choose One Your Security Team Will Approve
10 min read

Private AI for Business: How to Choose One Your Security Team Will Approve

A
Akash MunshiOctober 13, 2026

Private AI for business is any AI setup where you can prove where your data goes, who can see it, how long it's kept and that nobody trains on it. For most companies that means an enterprise SaaS plan for everyday chat plus a model endpoint inside your own cloud account for sensitive work. Self-hosting and air-gapped deployments are worth their cost only when regulation, contracts or data classification require them.

This is a buyer's guide. If you've already decided to run models yourself, our guide to hosting a private LLM for enterprise covers the build.

What makes an AI tool "private" enough for a business?

An AI tool is private enough when the vendor contractually commits not to train on your data, lets you control retention, keeps data in a region you choose, and gives you identity, audit and admin controls. Marketing pages say "enterprise-grade privacy" freely. Your security team will ask for the contract terms and the admin console.

Five properties separate a business-grade setup from a consumer one:

  1. No training on your inputs or outputs by default, written into the terms.
  2. Retention you control, ideally down to zero for API traffic.
  3. Data residency in your chosen region, for storage and, where offered, for processing.
  4. Single sign-on, user provisioning (SCIM) and role-based access.
  5. Audit logs you can export to your SIEM or eDiscovery tools.

Every major vendor now offers the first one on business plans. The differences show up in the other four, and in the fine print.

Which deployment model should you choose?

Choose the least isolated model that still meets your data classification. Each step toward isolation adds cost and operational work, and removes some model choice.

Deployment model Where data and models run Who operates it Best for Main trade-off
Vendor SaaS with enterprise terms Vendor's cloud, with no-training and retention controls Vendor Everyday chat, writing, analysis on internal data You rely on the vendor's controls and subprocessors
Private cloud / VPC Your cloud account, using a managed model endpoint (Bedrock, Azure, Vertex) or self-hosted models You, on cloud infrastructure Apps and agents touching customer or regulated data More engineering; managed endpoints still have provider terms
On-premises Your data centre, your GPUs, open-weight models You Strict residency or sovereignty, steady high usage Hardware, staff and model updates are your job
Air-gapped Isolated network with no internet connection You, or a vendor's disconnected appliance Defence, intelligence, critical infrastructure Limited models, manual updates, highest cost

Most companies end up with two tiers: SaaS for general staff and a VPC endpoint for production systems. Air-gapped setups have their own constraints, covered in air-gapped AI: what works without internet.

What will your security team ask before approving it?

Your security team will ask where data is stored and processed, how long it's kept, who can access it, and what the AI is allowed to do. Answer these ten questions for each option before you send the request.

  1. Training: Is there a contractual commitment not to train on our inputs and outputs, and does it cover feedback ratings?
  2. Retention: How long are prompts, outputs and files kept? Can we set it to zero, and does that need vendor approval?
  3. Abuse monitoring: Are prompts stored for human safety review, and can we opt out?
  4. Residency: Where is data stored at rest, and where is it processed? These are often different.
  5. Subprocessors: Which third parties touch the data? Are any models excluded from residency commitments?
  6. Identity: Do we get SAML SSO, SCIM provisioning and role-based access on this plan, or only a higher one?
  7. Audit: Can we export user activity and conversation logs to our SIEM?
  8. Model choice: Can we switch models or route to our own endpoints without changing the tool?
  9. Network: Can traffic stay on private networking (PrivateLink or private endpoints) instead of the public internet?
  10. Actions: If the AI can act (send email, change records, run code), who approves irreversible actions, and is each one logged?

Questions 4 and 5 catch most surprises. Microsoft's own documentation, for example, says Anthropic models are currently excluded from the EU Data Boundary in Microsoft Copilot. On Amazon Bedrock, some of the newest models require a retention mode where AWS keeps prompts and outputs for up to 30 days for review. "Private" can change per model inside the same product.

How do the main private AI options compare?

The options below are the ones most security teams already know. Prices and terms are as of October 2026 and link to the vendor's own pages in the sources.

Option Deployment Training on your data Retention control Residency Identity and audit Price (Oct 2026)
ChatGPT Business Vendor SaaS No Standard deletion within 30 days Not on Business; Enterprise only SSO, MFA $20/user/mo annual, $25 monthly; 2-seat minimum
ChatGPT Enterprise Vendor SaaS No by default Admin-controlled 10 regions at rest for new workspaces; in-region processing in EU, US, UAE SAML SSO, SCIM, Compliance API Not published; annual, per user, via sales
Claude Team / Enterprise Vendor SaaS No (commercial terms) Custom retention on Enterprise No region choice documented for Team or Enterprise; Claude API stores data in the US, with US-only or global inference SSO; Enterprise adds SCIM, audit logs, Compliance API Team $20/seat/mo annual; Enterprise $20/seat/mo plus usage at API rates
Microsoft Copilot Vendor SaaS in your Microsoft 365 tenant No foundation-model training Inherits tenant retention policies EU Data Boundary, with stated exceptions Entra ID, tenant audit $30/user/mo annual (Enterprise)
Gemini in Google Workspace Vendor SaaS in your Workspace Not outside your domain without permission Workspace retention settings Workspace data regions (not Gemini Notebook) Workspace SSO and audit Included in Workspace plans
Azure OpenAI (Microsoft Foundry) Your Azure subscription No; not available to OpenAI Stateless models; modified abuse monitoring by application Your geography, DataZone (US or EU) or Global Entra ID, Azure logs, private endpoints Pay per token
Amazon Bedrock Your AWS account No; not shared with model providers Per-account modes including zero, model-dependent Region you choose IAM, CloudTrail, PrivateLink Pay per token
Google Vertex AI (Gemini Enterprise Agent Platform) Your Google Cloud project No without permission Zero retention possible; 24-hour cache can be disabled Per-model residency controls IAM, VPC Service Controls, CMEK Pay per token
Self-hosted open-weight models Your VPC or data centre You decide You decide You decide Your stack GPUs plus staff
Google Distributed Cloud air-gapped Disconnected, in your or a partner's data centre No external connection You decide On site Your stack Contact sales
Cohere (North / private deployments) VPC, on-prem or air-gapped Private deployments: Cohere can't access prompts or outputs. SaaS: opt-out toggle You decide on self-deployed; SaaS logs deleted after 30 days On site Your stack Contact sales

A few notes the table can't carry. OpenAI doesn't publish ChatGPT Enterprise pricing: its pricing page says Enterprise is sold on annual plans, priced per user, through sales. OpenAI's API keeps inputs and outputs for up to 30 days unless you're approved for zero data retention. Anthropic also requires approval for zero data retention, and it applies per organisation.

On residency, Anthropic's data residency docs say the only workspace storage region on its API is currently the US, and inference runs either US-only (at 1.1x the standard token price on newer models) or globally. If you need EU processing for Claude models, ask Anthropic in writing or use a cloud provider's regional endpoint.

Cohere's enterprise data commitments say it has no access to prompts or generations on private and partner deployments. On its SaaS platform, you switch training use off in the dashboard. Google's Vertex AI caches inputs and outputs in memory for 24 hours by default, which you can turn off per project. Azure's "Global" deployment type may process prompts in any geography where the model runs, so pick Standard or DataZone if processing location matters.

What does private AI actually cost?

Seat-based SaaS is the cheapest way in, and self-hosting only wins at steady, high usage. Compare the three cost shapes before you compare vendors.

Seat plans cost $20 to $30 per user per month for the options above with published prices. A 500-person rollout at $30 a month is $180,000 a year, with no infrastructure to run.

Cloud model endpoints (Azure, Bedrock, Vertex) bill per token. They suit applications and agents whose usage you can estimate, and they keep data in your cloud account without GPUs to manage.

Self-hosting bills by GPU hour or hardware. Lambda lists an H100 SXM at $3.99 per GPU-hour. As an example, an 8-GPU node running all month costs about $23,000 at that rate (8 GPUs × 720 hours × $3.99), before engineering time. Lenovo's own TCO analysis of an 8-GPU H100 server against AWS on-demand pricing estimated break-even at about 12 months of round-the-clock use. That study is vendor-authored, predates AWS's mid-2025 GPU price cuts of up to 45%, and excludes staff and networking.

Staff is the cost buyers forget. Someone has to patch the serving stack, evaluate new open-weight models and handle incidents. If you can't name that person, a managed endpoint in your own cloud account is the better choice.

What changes when the AI is an agent, not a chatbot?

An AI agent server updating records and tickets, with an irreversible action held at an approval gate before it reaches the outbox

Agents act, so the checklist expands from "where does data go" to "what can it do, and who approved it". A chatbot that leaks is a data incident. An agent that sends the wrong email or deletes a record is an operational one.

Add four controls for agents:

  1. Isolated execution, so each task runs in its own sandbox with only the credentials it needs.
  2. Approval gates before irreversible actions such as sending, paying, deleting or deploying.
  3. A per-action audit trail: every tool call, every approval, tied to a named user.
  4. A model gateway, so all model traffic goes through one controlled path to endpoints you approve.

Our AI agent governance framework gives a template for policies, roles and review cycles you can adapt.

This is where Drevon Enterprise fits. It deploys AI agents for GTM, sales, marketing, ops and HR inside your own VPC or a fully air-gapped environment, with SSO, policy and approval gates before irreversible actions, a replayable audit trail of every agent and tool call, a model gateway to your own endpoints (Bedrock, Vertex or self-hosted LLMs on your GPUs), and isolated execution sandboxes destroyed after each task. For go-to-market teams, the AI lead generation playbook shows what those agents do day to day.

Which regulations and frameworks should shape your choice?

The EU AI Act, GDPR, and two voluntary frameworks (NIST AI RMF and ISO/IEC 42001) shape most enterprise AI approvals in 2026. Map your use cases to them before you pick a vendor, not after.

  1. EU AI Act: in force since 1 August 2024 and generally applicable from 2 August 2026. Obligations for general-purpose AI models applied from 2 August 2025. The 2026 AI Omnibus moved high-risk obligations for Annex III areas, such as employment, to 2 December 2027.
  2. GDPR: transfers to US providers can rely on the EU-US Data Privacy Framework adopted in July 2023 for participating companies, or on standard contractual clauses. Residency options reduce how much of this you need to argue.
  3. NIST AI RMF: a voluntary framework organised around four functions (Govern, Map, Measure, Manage), with a Generative AI Profile published in July 2024.
  4. ISO/IEC 42001: a certifiable AI management system standard. OpenAI and Google both list it among their certifications, which makes it a reasonable item to request from smaller vendors.

If you use AI in hiring or HR decisions, treat it as potentially high-risk under the AI Act and involve legal early.

How do you get private AI approved, step by step?

Get approval by classifying your data first, then matching each class to a deployment model. Security teams approve specific use cases faster than open-ended platforms.

  1. List your top five AI use cases and the data each one touches.
  2. Classify that data: public, internal, confidential, regulated.
  3. Map each class to a deployment model. Internal data to enterprise SaaS; confidential and regulated data to a VPC endpoint or self-hosted model.
  4. Shortlist two options per model and answer the ten security questions for each.
  5. Run a 30-day pilot with 20 users or one production workflow, with audit logging on from day one.
  6. Complete a data protection impact assessment for any use case that touches personal data.
  7. Ship with a review date. Vendor terms and model lists change every quarter.

Frequently asked questions

Is ChatGPT Enterprise private?

OpenAI says it does not train on ChatGPT Enterprise data by default, offers admin-controlled retention, SAML SSO and data residency in 10 regions for new workspaces. Whether that's private enough depends on your data classification and whether in-region processing (offered in the EU, US and UAE) is required.

What's the difference between private AI and a private LLM?

Private AI is the whole setup: data handling, identity, audit and the tools people use. A private LLM is one component, a model you host or access through a dedicated endpoint. You can have private AI without hosting a model yourself.

Do I need to self-host to keep data private?

Usually not. Azure OpenAI, Amazon Bedrock and Google Vertex AI keep data in your cloud account and commit not to train on it. Self-host when you need full control over the model, offline operation, or residency the cloud providers can't offer.

Can private AI run without internet access?

Yes, with open-weight models on your own hardware or a disconnected appliance such as Google Distributed Cloud air-gapped, which offers Gemini models and is built to remain disconnected. Expect fewer model options and manual updates.

How much does private AI cost per user?

Published enterprise seat prices for the options above run from $20 to $30 per user per month as of October 2026. ChatGPT Enterprise isn't published. Cloud endpoints bill per token, and self-hosting costs GPUs plus the staff to run them.

To see governed agents running inside your own VPC, book a Drevon Enterprise demo.

Sources

  1. OpenAI, "Enterprise privacy", accessed 2026-10-10.
  2. OpenAI Help, "What is ChatGPT Business", accessed 2026-10-10.
  3. OpenAI Help, "Managing billing on ChatGPT Business", accessed 2026-10-10.
  4. OpenAI, "ChatGPT Business plan page", accessed 2026-10-10.
  5. OpenAI, "ChatGPT pricing", accessed 2026-10-13.
  6. OpenAI Help, "Data residency and inference residency", accessed 2026-10-10.
  7. OpenAI API, "Your data", accessed 2026-10-10.
  8. OpenAI, "OpenAI Trust Portal", accessed 2026-10-10.
  9. Anthropic, "Claude pricing", accessed 2026-10-10.
  10. Anthropic, "Is my data used for model training", accessed 2026-10-10.
  11. Anthropic, "Zero data retention scope", accessed 2026-10-10.
  12. Anthropic, "Data residency", accessed 2026-10-13.
  13. Microsoft, "Enterprise data protection in Microsoft Copilot", accessed 2026-10-10.
  14. Microsoft, "Microsoft 365 Copilot Enterprise pricing", accessed 2026-10-10.
  15. Google Workspace, "Generative AI privacy hub", accessed 2026-10-10.
  16. Google Workspace blog, "Gemini included in Workspace plans", accessed 2026-10-10.
  17. Microsoft Foundry, "Data privacy for models sold by Azure", accessed 2026-10-10.
  18. Microsoft Foundry, "Abuse monitoring", accessed 2026-10-10.
  19. Amazon Web Services, "Amazon Bedrock FAQs", accessed 2026-10-10.
  20. Amazon Bedrock, "Data protection", accessed 2026-10-10.
  21. Amazon Bedrock, "Data retention", accessed 2026-10-10.
  22. Google Cloud, "Vertex AI data governance and zero data retention", accessed 2026-10-10.
  23. Google Cloud, "Model security controls", accessed 2026-10-10.
  24. Google Cloud, "Google Distributed Cloud air-gapped", accessed 2026-10-10.
  25. Cohere, "Private deployments", accessed 2026-10-13.
  26. Cohere, "Enterprise data commitments", accessed 2026-10-13.
  27. Lambda, "GPU cloud pricing", accessed 2026-10-10.
  28. Lenovo Press, "On-premise vs cloud generative AI TCO", accessed 2026-10-10.
  29. AWS, "EC2 GPU instance price reduction (June 2025)", accessed 2026-10-10.
  30. European Commission, "AI Act regulatory framework", accessed 2026-10-10.
  31. European Commission, "EU-US data transfers", accessed 2026-10-10.
  32. NIST, "AI Risk Management Framework", accessed 2026-10-10.
  33. Drevon, "Drevon Enterprise", accessed 2026-10-10.