Hybrid AI
How hybrid AI works at Ixvara
Choose where models run, which information they can use, and which actions require approval. We design and test these controls for your systems.
How a local-only system works
- 01Use only the sources the employee is allowed to access.
- 02Run the model in the agreed local environment.
- 03Show supporting sources and require approval where needed.
Local-only model execution has no automatic cloud fallback. Storage, backups, logs, and integrations are specified separately.
Control the information and the actions
Sources and permissions
Connect approved documents and records. Limit retrieval to the information each user is allowed to access.
Models and infrastructure
Specify the model endpoint, permitted data, performance requirements, operating cost, and release process.
Responses and actions
Provide supporting sources, escalate uncertain answers, and check approved actions after they run.
Illustrative system design. Model execution, storage, backups, logging, and external integrations each need explicit data-handling rules.
Choose where your AI runs
Hybrid deployment
The Ixvara AI firewall chooses per request among local, private cloud, and approved public models, by data sensitivity, quality, and cost. Each destination receives only the fields your policy allows it. Local-only workloads have no automatic cloud fallback.
- Workloads classified by data sensitivity and requirements
- Explicit permitted model destinations
- Requests routed per workload policy by the Ixvara AI firewall
- Sanitization available before a request reaches a public model
- Controls on retrieved context and consequential actions
- Costs, latency, and fallback behavior validated
We review model endpoints, network connections, storage, logs, and provider terms. A local-only workload is sent to a hosted model only after an explicit policy change.
Check, route, and mask, on every request
Hybrid works through the Ixvara AI firewall. It checks the user’s permissions and the workload’s data policy, then picks the destination and model by data sensitivity, quality, and cost: a model on your infrastructure, your private cloud, or an approved public model.
Your policy sets masking rules for each destination. Before a request leaves, the firewall masks or removes the names, identifiers, and fields that destination is not allowed to see. Local-only workloads are never routed to a hosted model.
Every request runs where your policy says
Illustration
Every request runs where your policy says
Illustration
Request
A user or workflow asks for work, with context retrieved under that user’s permissions.
Ixvara AI firewall
Checks permissions and the workload’s data policy, then picks the destination and model by data sensitivity, quality, and cost. Each destination’s masking rules apply before the request leaves.
Local model
Your servers, edge compute, or a validated IXBox cluster.
Private cloud model
Your cloud or dedicated infrastructure, terms reviewed.
Public model
Receives only the fields policy allows, where permitted.
Each destination receives only what your policy allows it. Local-only workloads are never routed to a hosted model.
We define masking rules, permitted destinations, routing criteria, and logging with your data policy, and we test them before release.
Private AI for day-to-day business work
Document processing
Extract and check document information, then route it into the right business system. Storage and retention follow your requirements.
Employee knowledge assistants
Help employees search approved sources and get answers with supporting evidence.
Workflow automation
Connect systems and automate steps under agreed access and approval rules.
What private AI means in practice
Can prompts and retrieved content stay inside our environment?
Yes, in a validated local-only deployment. Prompts, retrieved information, and model execution remain within the agreed environment, with no automatic cloud fallback. We specify storage, backups, logs, and external connections separately.
Can the system use both our local data and Microsoft 365?
Yes. Ixvara integrates private sources such as file shares, databases, and business applications alongside Microsoft 365 mail, files, and identity. Retrieval is permission-checked per user, and the model receives the context for the task rather than a connection into either environment.
Do cloud AI providers get access to our environment?
No. Where the data policy permits a hosted model, it receives the prompt and the retrieved context for that task. Providers hold no credentials to your tenant or network, and we review provider terms, logging, and retention as part of the data policy.
Can sensitive data be removed before a public model sees a request?
Yes. Your data policy sets masking rules for each destination, and the Ixvara AI firewall masks or removes the names, identifiers, and fields that destination may not see before the request leaves. The rules are defined and tested per workload, and local-only workloads are never sent to a hosted model.
Do we have to use IXBox?
No. We assess your existing infrastructure, model requirements, performance, and support needs. Supported local models can run on suitable customer infrastructure, edge compute, or a validated IXBox deployment.
What controls are needed beyond a private model?
Source permissions, user and service identities, tool access, approvals, testing, release control, and operating records. These controls cover the system around the model.
Does private AI automatically meet our compliance requirements?
No. Private deployment is one part of the design. Your compliance requirements must be reviewed against the full system, its controls, and the evidence available.
Can private and hosted models coexist?
Yes, if the data policy permits it. Define which workloads and information may use hosted models. Local-only workloads have no automatic cloud fallback.
How do we test whether the model is suitable?
Use representative tasks and failure cases to test answer quality, retrieval, response time, cost, and escalation. A pilot shows whether the design meets the agreed acceptance criteria.
Discuss your project
Tell us what needs to improve, the systems involved, and your data requirements.