Deployment modes: cloud, sovereign and hybrid
Same code, different data boundary. You choose where AI runs, per tenant and per matter.
Every external dependency sits behind a URL, so the deployment mode is a configuration choice, not a different build. What changes is the AI boundary.
| Mode | AI boundary | Use case |
|---|---|---|
| Cloud (quality) | Cloud frontier models; prompt-cached, no training | Fastest, most capable; the default |
| Sovereign | Fully local models; no model call reaches a third party | Sovereign deployments; confidential matters |
| Hybrid | Per tenant or per matter; sovereign tenants stay local | Mixed estates; routing by sensitivity |
| BYOK | Your own cloud key, on any mode | Your organisation controls the model contract and billing |
Trust
A sovereignty tenant never falls back to the cloud. This is enforced at startup, and a hard sovereign-only switch refuses to even construct a cloud backend. See Data sovereignty.
Two editions, one product. The managed cloud is billed on usage against a credit wallet. LexCore Sovereign is licensed instead: you run it on your own servers, pay a licence fee, and there is no per-review charge. Your AI capacity is limited by your hardware, not by a balance.
Related documentation
Data sovereignty and model routing
How the model router keeps a sovereign tenant's documents away from third-party model providers, and why where your analytics go is a separate question with its own control.
LexCore Sovereign: run it on your own servers
The self-hosted edition: what you receive, what you provide, and what it costs to run.
Bring your own key (BYOK) and self-hosting
Use your own model provider account, or run the whole stack on your own infrastructure.
Security architecture: isolation, encryption and access
Tenant isolation enforced in both the app and the database, AES-256 encryption with keys sourced from a KMS, and access gated by role and MFA.