1. Why a Private System Needs Redundancy
A family office assistant is used at the moment a decision cannot wait. A principal preparing for a closing at dawn, an estate manager coordinating a medical transfer, a counsel reviewing a document an hour before signature: these are the moments an outage costs most.
A cloud service meets this need with data-centre redundancy that the client never sees. A sovereign system has given up the cloud on purpose, so the continuity has to be built into the appliance itself. SARION Sovereign is that answer: two complete workstations that act as one system and keep working when one of them stops.
2. The Topology
SARION Sovereign is a dual-workstation cluster.
- Two workstations, physically separate, each carrying two GPUs.
- Four GPUs in total, with 192 GB of ECC memory per node and 384 GB across the cluster.
- A dedicated direct interconnect between the two nodes, separate from the household network.
- Two-way, real-time state replication between the nodes, with automated failover.
- Independent power: each node draws roughly 850 to 900 W under sustained load, sits on its own dedicated circuit, and ships with its own UPS.
+----------------------+ +----------------------+
| NODE A | | NODE B |
| 2 GPUs / 192 GB ECC |<========>| 2 GPUs / 192 GB ECC |
| own circuit, UPS | direct | own circuit, UPS |
+----------------------+ link +----------------------+
^ two-way state replication ^
+------------- single logical system -----+
The word that matters in that list is separate. Two GPUs in one chassis share a power supply, a motherboard, a cooling loop and a fate. Two workstations do not. The design buys independence between failure domains, which is the thing redundancy is for.
3. Pooled Capacity and Redundant Capacity
The two nodes serve two purposes at once, and a good briefing separates them.
When both are healthy, the cluster runs models across the full 384 GB memory space. That headroom is what allows trillion-parameter-class models and simultaneous multimodal generation, including local image and video synthesis, to run on-premise.
When one node is offline, the surviving node serves from its own 192 GB. That is half the memory. The design consequence is that the system must choose what to keep and what to slow down. In SARION Sovereign, core agentic conversation stays fully active, and heavy jobs such as video generation are throttled rather than dropped.
A system that fails all at once is simple to build. A system that keeps its most important functions alive on half its capacity needs deliberate prioritisation. The conversation, the agents and the family's documents come first. Long rendering jobs wait.
4. What Two-Way Replication Gives You
Replication means the surviving node already holds the working state when its partner disappears. The user does not repeat a conversation, re-attach a document or lose an agent's place. SARION Sovereign is designed so that a node taken offline for service leaves the cluster operating in degraded mode without dropping user context.
Two-way matters because either node can be the one that goes down. A design where only one node is the source of truth creates a single point of failure with an expensive spare attached. Symmetry removes the distinction.
5. What Replication Does Not Do
An honest memo states the limits.
- Replication is not backup. A mirrored system mirrors mistakes. A deleted document or a corrupted index can be copied across as faithfully as good data. Backup and retention are a separate decision, and families should settle them separately at commissioning.
- Two nodes in one building share a site. The design protects against hardware, power and maintenance failures at the level of a node. A fire, flood or theft affecting the whole premises is a different class of event, handled by site planning, physical separation of the two nodes within the property, and a distinct recovery plan.
- Capacity halves in degraded mode. The family should know in advance which workloads slow down, so that the first time they see it is not during a crisis.
6. Power and Placement
The power details in the topology are not incidental. A redundant pair that shares one circuit and one UPS has redundant computers and a single point of failure upstream of them.
SARION Sovereign puts each node on its own dedicated circuit with its own UPS. Placement then finishes the job. Where the property allows it, the two nodes belong in separate rooms or at least separate cabinets, on different electrical feeds, so that a tripped breaker, a water leak or a cooling fault affects one node and not both. UPS equipment should follow the performance and test requirements set out in IEC 62040-3, and the whole installation sits within the family's wider information-security governance, for example under ISO/IEC 27001.
7. Commissioning Checklist for the Architect
- Each node has its own dedicated circuit and its own UPS, confirmed on site.
- The two nodes are placed to avoid a shared electrical, thermal or water hazard.
- The direct interconnect is physically protected and kept apart from the household network.
- A planned failover test is run before handover: one node taken offline while the system is in use, then returned.
- The family has agreed which workloads slow down in degraded mode.
- A backup and retention policy exists, independent of replication.
- Service procedures name who may take a node offline, and when.
8. Reading the Design
SARION Sovereign is for the principal whose work cannot pause and whose data cannot leave. It gives up the cloud's convenience and replaces the cloud's redundancy with its own, inside the family's walls, under the family's control.
To review the topology against a specific property, contact our engineering team at volta.quest.