Comparison
The ways to run AI on confidential data.
Each approach makes a different trade between convenience and control. Here is how they compare with Vault-OS on the points security and compliance teams care about most.
Hosted chat assistants and model APIs
Public cloud AI services
- Where your data goes
- Your prompts and documents are processed on the provider’s servers, under the provider’s terms.
- The trade-off
- Fast to start, but confidential material leaves your control, which many contracts and regulations do not allow.
Cloud-managed racks installed in your building
Hybrid cloud hardware on premises
- Where your data goes
- The hardware sits in your building, but it is managed from the provider’s cloud.
- The trade-off
- Data stays closer to home, but the system depends on a permanent connection back to the provider.
Encrypted-memory virtual machines
Confidential computing in the cloud
- Where your data goes
- Workloads run in encrypted memory, on infrastructure the provider operates.
- The trade-off
- Strong isolation, but the environment, keys and attestation services remain the provider’s.
Open-source model runners
Do-it-yourself local tools
- Where your data goes
- Models run on your own machine, with no connection required.
- The trade-off
- The model runs locally, but access control, audit, encryption and support are left for you to build.
On your hardware, with no connection outside your network
Vault-OS
Everything runs on a machine you own, with no outbound connection. Documents live in an encrypted enclave under your own master password, access follows role and clearance, every privileged action is recorded in a signed audit ledger, and the licence is bound to your hardware and verified offline. IronGap supports it directly.
Side by side.
| Capability | Vault-OS | Public cloud AI | Hybrid cloud | Do-it-yourself |
|---|---|---|---|---|
| Runs with no internet connection | No | No | ||
| Data stays on hardware you own | No | Partly | ||
| Encrypted storage under your own key | No | No | No | |
| Role-based access and clearances | Varies | Varies | No | |
| Tamper-evident audit ledger | No | No | No | |
| Licence bound to your hardware | No | No | No | |
| Supported by the vendor | No |