Architecture, security model and practical guidance on running private AI for a regulated-industry firm without a cloud in the loop.