1. The Prompt Is the Disclosure
A family office does not hand an adviser its balance sheet by accident. It does so under a mandate, with a duty of confidentiality attached and a named person to hold accountable.
A cloud AI API gets the same material without any of that. A principal pastes a draft trust amendment into a chat window. An assistant summarises a tax opinion. A chief of staff asks for a reading of a cross-border share transfer. Each request leaves the building as text, lands on infrastructure the family does not own, and is handled under terms the family did not negotiate line by line.
The question for a private office is therefore simple to state. Where does the prompt go, who can read it there, and for how long does it exist? Local compute answers all three with the same sentence: nowhere, nobody, and only on hardware you own.
2. What Leaves the Building
Three kinds of data leave with a cloud request, and families tend to count only the first.
- The content. The documents and instructions typed or spoken into the system.
- The metadata. When requests are made, from which address, how often, and about which counterparties. A pattern of late-night queries during a negotiation says something even when no sentence is read.
- The model's behaviour over time. A hosted model can be changed, re-tuned or withdrawn by its vendor. A workflow calibrated on Monday can behave differently on Friday, and the client has no say in it.
Contractual assurances address the first item, partly. They do little for the second and nothing for the third. Jurisdiction adds a further layer: data held by a provider can be reachable by the legal process of the countries where that provider operates, with no obligation to inform the family.
3. What Zero Egress Means in Practice
Zero egress means the system works with no outbound connection at all. Nothing is sent to a vendor, and nothing waits on a vendor to function.
Disconnect the building from the internet. If the assistant still answers, reads the family's documents and runs its agents, the architecture is sovereign. If anything stops, something was leaving.
SARION Appliances are built to pass that test. Model weights sit on the appliance. The document memory sits on the appliance. Inference runs on the appliance. The SARION Confidant and SARION Regent tiers add a physical, manual isolation mechanism on the network interface, so the owner can sever external ingress and egress with a hand movement rather than a software setting. A software switch can be flipped by software. A physical one cannot.
4. A Household Is Not a Server Room
Air-gap guidance written for data centres assumes badge readers and locked cages. A prime residence has a different population: housekeeping staff, security teams, estate managers, visiting advisers, guests, builders, and a family whose members each have their own confidentiality needs.
This changes the design brief in three ways.
- The perimeter is social before it is technical. The question is rarely whether an attacker can break in. It is whether a trusted person with access to a room, a Wi-Fi password or a spare port can see what they should not.
- The family is not one user. A principal, a spouse and an adult child may each need a private context that the others cannot read, with deliberate sharing where they choose it. The Regent and Sovereign tiers support separate instances per family member with selective sharing.
- Discretion includes the hardware. A machine that is loud, hot or visibly industrial fails the residence even if it passes the audit. Closed-circuit liquid cooling and quiet acoustic design are part of the confidentiality brief, because a device people notice is a device people ask about.
5. Three Tiers, One Principle
The principle does not change with budget. The capacity does.
| Tier | Compute | Role |
|---|---|---|
| SARION Confidant | One workstation, 96 GB ECC GPU memory | Personal executive tier: bilingual conversation, voice, document analysis |
| SARION Regent | One workstation, 192 GB ECC GPU memory | Full agentic reach: email, calendar, tasks, tools configured for the client |
| SARION Sovereign | Two interconnected workstations, 384 GB ECC GPU memory in total | Dual-node scale with two-way replication and automated failover |
All three run on hardware the client owns, in the client's premises, with no subscription to a third-party model provider. What the tiers change is how much the system can hold and do, not how far its data travels.
6. The Commissioning Questions
An air-gapped appliance is only as sovereign as the process around it. Before commissioning, a family office or its architect should be able to get a clear answer to each of these.
- Which physical ports and interfaces exist, and who holds the means to open or close them?
- How are software and model updates delivered to a machine that is not permanently connected?
- Who holds credentials, and what happens to them when a member of staff leaves?
- Where do the machine's logs live, and who can read them?
- What is the plan if the device itself is threatened with seizure, loss or compromise?
On the last point, SARION Appliances include an owner-triggered emergency mechanism for irreversible destruction of the system's contents. We describe what it guarantees to the owner, and we discuss the detail directly with clients during consultation.
7. When Cloud Is Still the Right Tool
Not every task needs to stay home. Public research, drafting that contains nothing private and scheduling with outside parties can all use a cloud service without consequence. The discipline is in the boundary: decide in advance which categories of material may never leave, and give those categories hardware that cannot send them.
For the material that matters most, the family's governance documents, its legal strategy, its estate and security arrangements, the boundary should be physical.
For a technical review of how this applies to a specific property or office, contact our engineering team at volta.quest.