Deployment modes: cloud, sovereign & hybrid
Same code, different data boundary. Choose where AI runs by tenant and by matter.
Because every external dependency sits behind a URL, the deployment mode is a configuration choice, not a different build. The AI boundary is what changes.
| Mode | AI boundary | Use case |
|---|---|---|
| Cloud (quality) | Cloud frontier models; prompt-cached, no-training | Fastest, highest-capability; the default |
| Sovereign | Fully local models; no model call reaches a third party | Sovereign deploys; confidential matters |
| Hybrid | Per-tenant / per-matter; sovereign tenants stay local | Mixed estates; sensitivity-based routing |
| BYOK | Your own cloud key on any mode | Org controls the model contract + billing |
Trust
A sovereignty tenant never falls back to cloud — it is enforced at startup, and a hard sovereign-only switch refuses to even construct a cloud backend. See Data sovereignty.
Two editions, one product. The managed cloud is billed on usage against a credit wallet. LexCore Sovereign is licensed instead: you run it on your own servers, pay a licence fee, and there is no per-review charge — your AI capacity is limited by your hardware, not by a balance.
Related technical documentation
Data sovereignty & model routing
How the model router keeps a sovereign tenant's documents away from third-party model providers — and why where your ANALYTICS goes is a separate question with its own control.
LexCore Sovereign: run it on your own servers
The self-hosted edition — what you receive, what you provide, and what it costs to run.
Bring Your Own Key & self-hosting
Use your own model provider account, or run the whole stack behind your own infrastructure.
Security architecture: isolation, encryption & access
Tenant isolation enforced at both the app and database layers, AES-256 encryption with KMS key sourcing, and role- plus MFA-gated access.