Sovereign AI infrastructure — CanadaUnited States
We design, build, fine-tune, route, and run AI on infrastructure you own — flagship open weights like GLM-5.3-Flash, Kimi K3 and DeepSeek V4, frontier models where they earn their price, and the agent teams that run on both — with zero data egress, in Canada, under Canadian law.on American soil, under your control. Your documents, your code, your client files: none of it ever touches someone else’s cloud.
Built for firms governed by PIPEDA · Québec Law 25 · PHIPA · OSFI Guideline E-23 · law society confidentiality rulesHIPAA · GLBA · CMMC / ITAR · state privacy acts · attorney–client privilege
The 2026 inflection
A summer of events changed the calculus for every organization that depends on AI it doesn’t own — and then, in the last week of August, the open-weight field caught up.
The US government ordered Anthropic to block foreign access to its most advanced models — Fable 5 and Mythos 5 — within 48 hours, with no avenue for appeal. Organizations outside the US that had built workflows on rented frontier intelligence lost it overnight.
Two days later, Zhipu AI released GLM-5.2 — a 744B-parameter model with a 1-million-token context window — under the fully permissive MIT license, with no regional restrictions. It lands within a few points of Claude Opus 4.8 on key agentic benchmarks at a fraction of the cost, and anyone can download and run it.
Moonshot AI released Kimi K3 — 2.8 trillion parameters, 1M-token context, native vision — which beat Claude Opus 4.8 and GPT-5.5 on coding and agentic benchmarks at launch, ranking as the third most capable model in independent testing. For eleven days the only way to use it was Moonshot’s own API — routed through Chinese servers — and even the reviewers most excited about it said the same thing: don’t put sensitive data through it. Wait for the weights.
Moonshot published the Kimi K3 checkpoint on Hugging Face — 1.56 TB, 104B active parameters, native vision — under the Kimi K3 License. From that moment a frontier-tier model is a static file you can audit, air-gap, fine-tune, and own, with no US or Chinese provider anywhere in the chain. The organizations that benefited on day one were the ones whose infrastructure was already racked.
GLM-5.3-Flash (MIT, 320B/18B active, multimodal), Qwen3.8-Flash-Next (125B/6B active), GLM-5.3 (753B, Terminal-Bench 2.1 88.2), Tencent Hy4-preview (Apache 2.0, 770B/49B) and DeepSeek V4-Flash-Vision (MIT) all shipped weights between August 25 and 31 — on top of DeepSeek V4-Pro (MIT), Meta’s Apache-2.0 return with Muse Glimmer, and IBM Granite 4.2 earlier in the month. The capability premium for closed APIs on coding and agent work collapsed. Licenses, not benchmarks, are now the differentiator.
Anthropic shipped Claude Fable 5.1 and a vetted-organizations-only Mythos 5.1; Google shipped Gemini 3.8 Flash and a government-gated Cyber variant. Then OpenAI released GPT-6 Astra — by its own classification the first model to cross the “Critical” cybersecurity threshold — reviewed with the US government before launch, rolled out first to a vetted Trusted Access tier, and switched off by default for enterprise workspaces. The pattern is settled: the most capable rented models come with access controls decided in someone else’s capital. The most capable owned models come as a download.
OTTAWA AGREES — Canada’s $2B Sovereign AI Compute Strategy, including the C$300M AI Compute Access Fund that subsidizes eligible organizations’ compute purchases, is federal policy built on the same premise: Canadian data and IP belong on Canadian-controlled compute. Private sovereign deployment is the same move, made for your own firm.
Free download
Calendar audits, hiring scorecards, quarterly calibration, key-person continuity plans and 36 more — built from the Vault Conference 2026 stage and written so Claude can run them with you. Plus the sovereignty briefing: open-weight model releases, deployment economics and regulatory shifts, analyzed for regulated firms.
~/.claude/skills/ or Claude.ai in under a minute.What we do
Sovereign AI fails when it’s treated as an IT project. We deliver it as a complete practice — from hardware procurement to the fine-tune that makes the model speak your firm’s language, the routing layer that puts frontier models beside your own, and the agent teams that run on it.
GPU cluster design and procurement sized to your models and concurrency — from a single hardened inference node to multi-node clusters. On your premises, in Canadiandomestic colocation, or air-gapped entirely.
ON-PREMISE DEPLOYMENT →Parameter-efficient fine-tuning on your precedents, records, tickets, and code — trained inside your environment, evaluated against a harness built from your real work. The model learns your formats, terminology, and standards.
FINE-TUNING →Claude, GPT-5.6, Gemini and Grok through region-pinned endpoints for the hardest reasoning; open and customized weights on your hardware for volume and anything sensitive; agent harnesses like Hermes, OpenClaw and Grok Bot behind a gateway you own.
FRONTIER & ROUTING →Tuned open models on Cerebras-, Groq- or Blackwell-class inference, wrapped in production pipelines — video search and analysis, security operations, robotics and real-time voice — run as a service with an SLA.
OPTIMIZED INFERENCE →Production serving with SSO, role-based access, audit logging, and observability — every token generated on hardware in Canada, under Canadian jurisdictionthe United States, under US jurisdiction. Zero third-party API calls.
HOSTING →Open-weight releases now arrive monthly. We evaluate new models against your workloads, migrate fine-tunes, patch serving stacks, and keep your deployment improving — on your schedule, not a vendor’s deprecation calendar.
MAINTENANCE →The model bench
The open-weight field is no longer the budget tier. These are the models we deploy today — selected, quantized, and served to match your workload and governance requirements.
| Model | Scale | Context | Strengths | License / weights |
|---|---|---|---|---|
| GLM-5.3-Flash Zhipu AI / Z.ai | 320B MoE · 18B active — new hybrid-attention base. ~200 GB at 4-bit, ~306 GiB at FP8; single-node serving | 1M tokens · native vision (images, video, documents) | The new workhorse: general assistant, agentic coding and tool use (DeepSWE 63.4 vs GLM-5.2’s 46.2), structured extraction, document and image understanding — one checkpoint where GLM-5.2 needed a vision partner. | MIT · Aug 25–26, 2026 |
| GLM-5.3 Zhipu AI / Z.ai | 753B MoE · ~40B active — same base as GLM-5.2; ~245–400 GB at 2–4-bit, 8-GPU node | 1M tokens · text-only | The strongest open agentic-coding model: Terminal-Bench 2.1 88.2, Terminal-Bench 3.0 28.3 (GLM-5.2: 4.6), DeepSWE 66.9, CyberGym 84.5. An in-place checkpoint swap for GLM-5.2 racks. | GLM-5.3 License · Aug 28 |
| Kimi K3 Moonshot AI | 2.8T MoE · 104B active — largest open model released. 1.56 TB checkpoint; supernode-class serving (64+ accelerators) | 1M tokens · native vision | Deep long-horizon runs (3+ hour autonomous sessions, 100+ tasks from one prompt), vision-in-the-loop UI work, document & spreadsheet analysis. Terminal-Bench 2.1 88.3, GPQA Diamond 93.5; the best open model at admitting what it doesn’t know. | Kimi K3 License · weights Jul 27 Managed cluster tier |
| DeepSeek V4 DeepSeek | V4-Pro-0813: 1.6–1.7T MoE · 49B active (~893 GB) · V4-Flash: 284B · 13B active | 1M tokens · Flash-Vision variant adds images | Cost-efficient frontier reasoning at scale (Terminal-Bench 2.1 87.9 on Pro); the batch engine for high-volume analysis, extraction and classification. | MIT |
| Qwen3.8 family Alibaba | Flash-Next: 125B · 6B active + 51B N-gram table in system RAM · 27B dense · 2.4T Max | 262K native → 1M · multimodal | Efficiency and document/vision work. Flash-Next runs in ~75–110 GB quantized and previews the Qwen4 architecture; Qwen3.8-27B is the Apache-2.0 workstation model. | Qwen Community 1.0 · Apache 2.0 (27B) |
| Llama · Mistral Meta / Mistral AI | Multiple scales | Long context | Western-origin open weights for organizations whose procurement or security policy requires them. | Open weights |
On model origin: self-hosted open weights are static files — audited, checksummed, and incapable of transmitting anything. No data flows back to the lab that trained them, and fully air-gapped operation is available. Where policy requires Western-origin models regardless, we deploy them. Sovereignty means the choice is yours.
On honest sizing: full-precision K3 is supercomputer-class — Moonshot itself recommends 64+ accelerators. Most organizations don’t need that, and we won’t pretend otherwise. GLM-5.3-Flash’s 18B-active design puts a frontier-class, multimodal, MIT-licensed model on a single node; the full GLM-5.3 fills an 8-GPU node; K3 is available through large-cluster builds or our managed sovereign facility tier. The assessment tells you which tier your workloads actually justify. See the full model bench →
Field-tested capabilities
These aren’t launch-page claims — they’re what independent reviewers verified in real-world testing of this model class in the first 24 hours.
Multi-hour autonomous runs. 3+ hours and 122 tasks completed from a single paragraph-long prompt — full codebase migrations and overhauls with minimal supervision. Overnight, on your hardware, at zero marginal cost.
Sub-agent swarms. Spins up teams of parallel agents — 25 verification agents in one observed audit — that divide work, check each other, and synthesize results. Frontier-grade delegation, self-hosted.
Sees its own work. Native vision means it screenshots the UI, dashboard, or document it just produced, critiques it, and iterates — validated on real production front-end work, not demos.
Documents, spreadsheets, research. Benchmark leader on spreadsheet and knowledge-work evaluations; generates full research reports, financial analysis, and dashboards from your internal data.
Security review of your own systems. Deep audits of your own infrastructure and code — the defensive work every firm should be running continuously, kept entirely in-house where findings belong.
Screen agents without the surveillance trade. Cloud computer-use agents stream screenshots of your employees’ desktops to a US lab. An on-prem agent does the same clicking, filing, and form-filling — and every pixel stays inside your walls.
Why organizations move
Residency clauses in a vendor contract are promises. Data that physically never leaves your infrastructure is proof — the kind auditors, regulators, and privacy commissionerscompliance officers accept without argument.
The US CLOUD Act lets American authorities compel US providers to hand over data — even data sitting in a Canadian cloud region. That’s a direct conflict with Law 25 and confidentiality duties. Infrastructure you own has no US provider in the chain to compel.When your AI runs through a vendor, that vendor’s logs, retention policies, and legal exposure become yours. Owned infrastructure means privileged and proprietary material has exactly one custodian: you.
Metered APIs get more expensive the more your team uses them — which quietly punishes adoption. Owned infrastructure inverts that: cost per token falls as usage grows, and overnight batch work — document review, analysis, drafting queues — runs at zero marginal cost.
Every prompt to a frontier lab describes how you work. Your precedents, processes, code, and pricing logic are exactly the material that trains the systems that could commoditize you. Self-hosted models learn from your data for your benefit — and no one else’s.
Security-industry surveys consistently find roughly a quarter of employees admit to pasting confidential company data into public AI tools. Bans don’t stop it — people route around them with personal accounts. What stops it is an approved tool good enough that nobody needs to sneak: unlimited seats, no meter, tuned to your actual work, inside your security perimeter.
Export orders, deprecations, price hikes, and terms-of-service changes all stop at your rack. The model version you validated keeps running until you decide to upgrade it — a dependable colleague that works nights and weekends and never changes behaviour without notice.
Deployment blueprints
Representative architectures for the sectors where the case is strongest — the pattern each deployment follows, and what it unlocks.
A 120-lawyer Toronto firm120-attorney Chicago firm deploys GLM-5.3-Flash fine-tuned on two decades of firm precedents. Matter summarization, first-pass discovery triage across million-token document sets, and precedent-aware drafting — all inside the firm’s own network, so privileged material never transits a third party and law society confidentiality duties are satisfied by designprivilege is never placed at risk with an outside vendor.
A multi-clinic Ontario networkmulti-clinic regional network runs GLM-5.3-Flash and a tuned language model for ambient scribing, referral letters, and coding suggestions. Personal health information never leaves the LAN — no cross-border transfer analysis, no vendor PHIPA agreements to policePHI never leaves the network — a dramatically simpler HIPAA posture than chains of business associate agreements, and clinicians get back the hours the paperwork was taking.
A commercial general contractor runs a second brain over drawings, RFIs, change orders, bids and outcomes, with agents that pre-qualify RFQs, draft proposals from past submissions and underwrite deals from the firm’s own cost history — supervised by an agent that runs the schedule. Bid data and unit costs never leave the building, and the documented workflows are what a buyer or lender later prices as a software-enabled company.
A prairie credit unionregional bank deploys a member-service copilot and document-processing pipeline on owned hardware. Every model version is pinned, evaluated, and documented — a clean OSFI Guideline E-23 model-risk filemodel-risk file for examiners — while member data, lending files, and internal analytics stay entirely inside the institution’s perimeter.
A precision manufacturer’s process knowledge — decades of CAD notes, tolerances, failure analyses, and supplier terms — is exactly what it can never paste into a public chatbot. A tuned on-premise model turns that archive into an internal expert: searchable, conversational, and available to every engineer, with ITAR-controlled technical data never leaving authorized systems.
Blueprints are representative reference architectures, anonymized and generalized from the deployment patterns we design. Full write-ups live in case studies; sector detail in industries.
More blueprints (September 2026): a BDR agent team for any industry · a lifecycle agent team from signup to renewal · a Hermes fleet on hybrid routing · Grok Bot beside a self-hosted fleet · OpenClaw sovereign workstations · ultra-fast inference for video, security and robotics · digital twins and multimodal agents. All deployment blueprints →
The honest comparison
| Frontier cloud API | Sovereign on-prem (Chels.ai) | |
|---|---|---|
| Where your data lives | Vendor infrastructure, vendor logs, vendor retention policy | ✓ Your hardware, in Canadaon US soil — egress: 0 bytes |
| Who can be compelled to disclose it | US provider — subject to the CLOUD Act even for Canadian regionsThe vendor, under their legal exposure, not yours | ✓ Only you, under Canadianyour own legal process |
| Cost at heavy internal use | Metered — scales up with every prompt, punishing adoption | ✓ Fixed — cost per token falls as usage grows |
| Model lifecycle | Versions deprecated and behaviour changed on the vendor’s schedule | ✓ Pinned versions; upgrades on your schedule |
| Fine-tuning on confidential data | ✗ Requires shipping your most sensitive corpus to a third party | ✓ Trained inside your environment; adapters stay yours |
| Availability under export policy | ✗ Revocable — foreign access to top US models was cut off in June 2026 | ✓ Weights on your disks; nothing to revoke |
| Peak capability | The absolute newest proprietary flagships still lead some benchmarks | Last-generation-flagship level (Opus 4.8 / GPT-5.5 tier) — owned, unlimited, 24/7 |
The engagement
Map your data classes, obligations, workloads, and the concurrency you actually need. Output: a written architecture and cost model.
WEEKS 1–2GPU cluster design, procurement, and site prep — premises, Canadian colodomestic colo, or air-gapped.
WEEKS 2–6 · PARALLELServing stack, SSO, role-based access, audit logging, monitoring. Security review before any real data touches the system.
WEEKS 5–8Fine-tune on your corpus in-environment; build an eval harness from your real work; iterate until it clears your bar.
WEEKS 7–10Staged rollout, training, and a managed retainer: patches, evals of new model releases, and migrations when they win.
ONGOINGQuestions we get
It isn’t categorically prohibited — but it’s hard to do defensibly. Law society confidentiality duties, Law 25’s cross-border transfer assessments, and the US CLOUD Act’s reach over American providers stack risk on every privileged prompt. A sovereign deployment removes the question: privileged material never leaves infrastructure the firm owns.Often yes, with enough contractual scaffolding — business associate agreements, data processing addenda, vendor audits. But every layer of scaffolding is something to police. Owned infrastructure replaces the paperwork with physics: the data simply never leaves.
As of September 2026, effectively yes for most enterprise work. GLM-5.3 posts Terminal-Bench 2.1 88.2 and Kimi K3 88.3 — frontier-class agentic-coding scores from weights you can download — and GLM-5.3-Flash approaches Claude Opus 4.8 on coding and agentic benchmarks while fitting on one node under an MIT license. K3 is also the best open model at admitting uncertainty rather than hallucinating, which matters enormously in legal, health, and financial work. The very newest proprietary flagships still lead some benchmarks — but those are the same models that ship with export restrictions and gated access tiers. Owned flagship-tier intelligence, unlimited and always on, beats rented access you can lose overnight.
Because every API prompt routes through the provider’s servers — and for Zhipu, Moonshot and DeepSeek, that means Chinese infrastructure. Even the reviewers most enthusiastic about these models say plainly: don’t put sensitive data through the hosted APIs. The APIs are fine for evaluation with non-sensitive material. For client files, patient records, or proprietary code, the only defensible path is the one this firm builds: open weights, downloaded, checksummed, and served on infrastructure you own. Every model on our bench has published weights today — GLM-5.3-Flash’s 4-bit build is about 200 GB — so nothing about the workload needs to leave your perimeter.
Open weights are static files — numbers on a disk with no ability to transmit anything. Self-hosted, they run inside your network (fully air-gapped if required) with all traffic under your monitoring; nothing flows back to the lab that trained them. And where procurement policy requires Western-origin models, we deploy Llama, Mistral, and other alternatives. Sovereignty means model origin is a governance choice you get to make.
It scales with model size, precision, and concurrency — and we’ll be straight about the tiers. A single-rack deployment serving GLM-5.2-class models (40B active parameters) to a workgroup starts in the low-to-mid six figures of hardware. Full-precision Kimi K3 is genuinely supercomputer-class — Moonshot recommends 64+ accelerators, a multi-million-dollar cluster — which is why we offer it through large enterprise builds or a managed sovereign facility tier rather than pretending it fits in a closet. The structural difference from cloud APIs holds at every tier: per-token cost falls as usage grows, and overnight batch work is free at the margin. The assessment produces a real cost model against your projected usage before you commit to anything.
Training runs on the same in-environment hardware that serves inference (or dedicated in-country training nodes). We use parameter-efficient methods — LoRA and adapters — over your corpus, and evaluate against a test harness built from your actual documents and tasks. The resulting adapters are your property, portable across model upgrades. More detail: fine-tuning & customization.
No. Three patterns work: a hardened server room on your premises, your own rack in a Canadiana domestic colocation facility, or managed hosting on hardware dedicated to you in-country. Residency and control stay yours in every pattern — the only difference is who handles physical operations.
Your infrastructure is model-agnostic, and open-weight releases now arrive monthly. The maintenance retainer includes benchmarking major releases against your workloads, migrating your fine-tunes, and upgrading serving stacks — so the same hardware gets smarter over time, on your schedule.
The CLOUD Act lets US authorities compel American providers to disclose data they hold — including data stored in Canadian cloud regions. That collides directly with Law 25’s disclosure restrictions and with confidentiality duties in law, health, and finance. Owned infrastructure running open weights has no US provider in the chain to compel.
ITAR-controlled technical data and CUI can’t flow through systems outside your authorization boundary — which rules out most public AI APIs outright. On-premise open-weight deployment keeps controlled data inside authorized systems while still giving engineering and program teams frontier-class assistance. See defense & aerospace.
Six to twelve weeks from kickoff to production in most engagements: assessment and architecture in the first two weeks, hardware procurement in parallel, then deployment, hardening, fine-tuning, and a staged rollout. Managed operations continue from there.
Two weeks. We map your data obligations and workloads, size the hardware, and hand you a written architecture with a real cost model — whether or not you build with us.
This page: 0 trackers · 0 external requests · system fonts only.