What stays inside the boundary

Self-host means the portal, the control plane, the governed AI, and your compliance evidence run on your stack. Key points:

• Data sovereignty and residency are met by where the platform runs, not by a vendor promise. The core is yours to read and run, so there is no black box at the center of a sovereignty review.
• Be explicit about the boundary in your design: what data crosses it, what never does, and which dependencies (model providers, registries, package mirrors) must be brought inside or mirrored for an air-gapped install.
• Governed AI does not require an outside provider. State how the model layer is served inside the boundary when no egress is allowed.