Inside a Real AI Company in a Box: The Sovereign Stack Model
An archived overview of a four-level model for infrastructure, governance, bounded agent roles, and operational maintenance.
Originally published on the VaHive Systems Lab website. This archive preserves the original piece; its examples, figures, and product references reflect the original publication context and are not current Virasai AI commitments.
Self-hosting AI agents without data leakage is achieved through a layered architecture that segregates reasoning from execution and keeps all sensitive data on infrastructure under your control. The stack operates in four levels, creating a cohesive "Company in a Box":
* **Level 0:** Secure infrastructure foundation with isolation and containment.
* **Level 1:** Governance operating system enforcing separation and oversight.
* **Level 2:** Bounded staff roles with narrow mandates.
* **Level 3:** Maintenance layer for observability and cost control.
In this model, reasoning happens with sanitized inputs (PII tokenized), while execution rehydrates data only at validated steps on your own node. No raw customer information ever reaches external providers.
### What Causes Data Leakage in Cloud AI
Leakage occurs through prompt transmission — the fundamental mechanism of cloud LLMs. Primary causes include:
* **Direct context inclusion:** Agents require full conversation history for coherence, sending PII unmasked.
* **RAG retrieval:** Database pulls inject unfiltered records into prompts.
* **Accumulated threads:** Long interactions build up sensitive history.
* **Provider logging:** Inputs captured for debugging or improvement.
The risk is not hypothetical. Once transmitted, data is subject to provider policies, breaches, or subpoenas. For technical founders building products with customer data, cloud dependency means surrendering sovereignty.
### What a Sovereign AI Stack Is
A sovereign AI stack runs all sensitive operations on owned infrastructure, using external LLMs only with sanitized inputs. The four levels form a closed loop:
DIAGRAM: The Closed Loop System
[ LEVEL 3: MAINTENANCE (Mechanic) ]
^ |
Observability Fixes
| v
[ LEVEL 2: STAFF (Specialists) ]
^
|
[ LEVEL 1: GOVERNANCE OS ]
|
Reasoning <--> Execution
|
[ LEVEL 0: INFRASTRUCTURE (The Node) ]
### Level 0 Architecture Overview
Level 0 establishes exclusive control through a dedicated node. Implementation involves provisioning a VPS with root access, installing Docker Compose, and deploying PostgreSQL and n8n on a private network.
**Checklist:**
* Exclusive tenant (no shared memory inspection)
* Private bridge network
* Environment variables for secrets
* Encrypted volumes
* Tested backups
DIAGRAM: Level 0 Isolation
[ INTERNET ] --x-- [ SHIELD ] --x-- [ DB ]
|
[ LLM API ] <--> [ Airlock (n8n) ] <--> [ Internal API ]
|
[ Vector Store ]
### PII Airlocks & Tokenization
The airlock ensures reasoning sees no real identities. We detect patterns (regex for emails, phones) and replace them with tokens. Reasoning happens on sanitized context, and data is rehydrated in the automation layer only after validation. This preserves intent while eliminating exposure.
### Docker Jails & Isolation
Containers enforce lateral containment. By using separate containers per service, strict resource limits, and non-root users, any compromise is kept local to that specific container.
### RLS and Permission Walls
Row-Level Security makes the database self-defending. By enabling RLS and defining policies on session context, the database enforces rules even if the application layer tries to bypass them.
### Red Button Kill-Switch
Immediate containment for runaway issues. This is a script to stop containers or disable the queue, triggered manually or on thresholds. It freezes all state changes, stopping damage first.
### Cost Comparison vs Cloud AI
| Volume | Cloud AI | Sovereign Stack |
| :--- | :--- | :--- |
| Low (200/day) | $300–800/mo | $50–150/mo |
| Med (1000/day) | $1500–4000/mo | $150–400/mo |
| Long Term | Price Hikes | Predictable |
### Why Doctrine Matters
Most founders fail because they port cloud patterns to self-hosting — keeping broad agents, mixed execution, and verbose prompts — resulting in complex, leaky systems that collapse under real load. A doctrine approach matters because it provides layered consistency: secure base (Level 0), governed operations (Level 1), bounded staff (Level 2), and sustained maintenance (Level 3). Without this structure, attempts fragment into fragile hacks.