Your model, running where your data is allowed to be.
In your cloud account, your data centre, a network with no internet access, or a single-tenant environment we run for you. You choose based on your risk appetite, not our convenience.
Four options
Pick the boundary. We work inside it.
Your cloud
In your own AWS, Azure or Google Cloud account, in your region, behind your network controls and encrypted with your keys.
for: teams already approved for a cloud provider
Your cloud: full details →Your data centre
On GPUs you own or lease, connected to your identity provider, your logging and your change process.
for: data that can’t go to a public cloud
Your data centre: full details →Air-gapped
No internet connection. We deliver models and updates as signed bundles with a software bill of materials, and your team verifies them before install.
for: the most sensitive workloads
Air-gapped: full details →Hosted by us
A single-tenant environment we operate for you, locked to one region and not shared with other clients. Named engineers only, with every access logged.
region, RTO and RPO configurable per contract
Hosted by us: full details →Technical detail
What we install, and how we size it.
Serving
vLLM or SGLang for most workloads, TensorRT-LLM where peak throughput on NVIDIA hardware matters. A standard API in front.
vLLM · SGLang · TensorRT-LLM
Quantisation
FP8 on recent GPUs is close to lossless for most tasks. 4-bit AWQ or GPTQ when memory is tight. We re-run your tests after every change and report the difference.
FP8 · AWQ · GPTQ
Sizing
A 70B-parameter model needs about 140 GB for weights at 16-bit, 70 GB at FP8 and 35–40 GB at 4-bit, plus memory for each conversation in flight. We size from measured throughput at your expected load.
Delivered with every deployment: Terraform / Helm · Kubernetes with GPU operator · no outbound traffic by default · private endpoints · your keys (KMS / HSM) · logs to your SIEM · signed images and SBOM · runbook · disaster-recovery test
Who has access
No standing access for us.
In your cloud, data centre or air-gapped network, our engineers have no permanent access. When we need to work on the system, access is granted just in time through your privileged-access tooling, and every session is logged by you.
In the hosted option, access is limited to named engineers, emergency access is logged and reviewed, and you receive the access log on request.
Regulation
Outsourcing rules, built into the contract.
| Framework | What it asks | How we support it |
|---|---|---|
| MAS Outsourcing Guidelines (Banks), Notice 658 | Due diligence, contract terms and audit rights for outsourced services. | We accept audit and access rights for you and MAS, and support your materiality assessment. |
| MAS Technology Risk Management Guidelines | Controls for access, cryptography, resilience and third parties. | Our controls mapped to the relevant sections. |
| DORA Art. 28–30 | A register of ICT providers, exit strategies and mandatory contract terms. | Contract terms written for Art. 30, an exit plan and the data you need for your register. |
| EBA Outsourcing Guidelines | Governance of outsourced functions in EU banks. | Documentation for your outsourcing assessment. |
Questions
What security teams ask.
Does any Arthiq system keep access to ours?
No. Access is granted per task through your tools and removed afterwards.
Will you sign our outsourcing or DORA addendum?
Yes, including audit and access rights for you and your regulator.
How do updates reach an air-gapped site?
As signed bundles with a software bill of materials. Your team checks the signatures and installs them.
What are the recovery targets for the hosted option?
Region, RTO and RPO are configurable per contract. We test recovery and share the results.
Which infrastructure provider runs the hosted option?
It’s configurable. We agree the infrastructure provider with you.
What we don’t promise
Some claims we won’t make.
- “MAS-approved”, “DORA-certified” or “HIPAA-certified”. Regulators don’t certify vendors this way.
- Zero data retention, unless your logging configuration enforces it.
- That our hosted option is air-gapped. It isn’t; choose air-gapped if you need that.
Choose your boundary.
We’ll walk your infrastructure and security teams through each option.