An AI coding agent that never leaves the building
A security-sensitive enterprise wanted AI-assisted coding. Compliance said no data could ever leave their network. So we moved the entire system inside it.
- Client
- Security-sensitive enterprise (NDA)
- Industry
- Developer tooling
- Engagement
- Client build, fixed scope
- Constraint
- Zero data egress permitted
The problem
"Can we use AI?" vs. "Can our data leave?"
Their developers wanted what every team wants: autocomplete, refactoring help, and faster code review. But for this client, the second question had a fixed answer. No.
No source code can leave the network
Compliance forbade any code, context, or telemetry from touching third-party clouds. That rules out every frontier API — the entire system had to run inside their perimeter.
No exceptions, even for inference
Most "private" AI setups still phone home for embeddings, reranking, or model calls. Here, even a single outbound request was a compliance violation.
Security sign-off required
Every component had to pass their internal security review before developers could use it. Architecture diagrams and audit logs were deliverables, not afterthoughts.
What we built
Everything the agent needs, inside their perimeter
01
Open-weight model, self-hosted
We traded the strongest frontier model for a strong open-weight coding model running on their own GPUs. For a scoped task — one language, one codebase — the capability gap was small and shrinking.
02
Private retrieval over their repos
Their codebase is indexed in a vector store that lives inside the network. The model grounds every suggestion in their actual code without anything leaving the perimeter.
03
Sandboxed tool execution
When the agent runs code, tests, or refactors, it executes inside a sandboxed environment on their infrastructure. No action reaches developer machines or shared systems uncontrolled.
04
Eval harness before rollout
We built the evaluation suite before the agent: representative tasks, pass/fail scorers, and regression checks on every model or prompt change. Their team can verify quality themselves.
05
Full audit logging
Every suggestion, tool call, and retrieval is logged inside their systems. Compliance can replay exactly what the agent saw and did on any given run.
The honest trade-offs
What on-prem costs you
On-prem buys privacy and control. It costs some raw model capability and some operational overhead: the client now owns the model lifecycle, GPU capacity planning, and the upgrade cadence. For a scoped task like coding in one language on one codebase, the open-weight model was more than enough.
With their compliance team, the winning argument was never "the AI is smarter." It was "no data ever crosses the boundary, and here is the network diagram and audit log to prove it." On-prem turned AI from a policy fight into an architecture review.
Surfaces
Where developers actually use it
The agent meets developers inside the tools they already use. Interface mockups, simplified for illustration.
Explorer
▾ FINANCE-REPORTS
▾ pipelines
🐍 settlement_pipeline.py
🐍 reconcile.py
🐍 fx_rates.py
🐍 retry_utils.py U
▸ tests
▸ .atvos
requirements.txt
pipelines > settlement_pipeline.py
41def post_settlement(batch: Batch) -> Receipt:
42 payload = batch.to_wire()
43 res = requests.post(LEDGER_URL, json=payload)
44 return Receipt.from_json(res.json())
45
Ativos Agent
on-premyou
add retries — ledger gateway drops under load
agent · qwen3-32b (local)
run #1,204 · logged to audit trail
refactor(auth.ts) — rotate token expiry check
dev: s.park · touches 3 files · eval score 0.94
explain(query-plans.ts) — plan analysis
dev: m.osei · read-only · eval score 0.98
migrate(secrets.env) — read secrets file
policy: secrets/ is outside agent scope
audit log · 1,204 actions this month · every plan, tool call, and result replayable
IDE extensions
VS Code and JetBrains: inline suggestions, diff review, explain-this-code, and chat scoped to their repos.
CLI & pre-commit
Terminal access for scripted refactors and review, plus a pre-commit hook that flags risky changes.
CI gate
PR pipeline step that scores agent-touched diffs against the eval suite before merge.
How the engagement ran
What working with us looked like
Started with their constraint, not our pitch
The first meeting was with their security team, not their developers. We mapped what was off-limits before proposing anything.
Made every assumption visible
Each architectural choice came with the reasoning attached: why this model, why this hardware tier, what it trades away. Their team could challenge decisions before they were built.
Proved safety before showing capability
The eval harness and network diagram went to compliance in week two. The working demo came after the boundary was verified, not before.
Showed impact before rollout
Before touching developer machines, we ran the agent on a shadow repo so their team could inspect suggestions, logs, and failure modes safely.
Handed over the keys
Model lifecycle, GPU capacity, eval suite, and docs all transferred to their engineers. They can retrain, swap models, or fork the system without us.
The outcome
Cleared by security, used by developers
Developers got autocomplete, refactoring, and review assistance with zero data egress. The deployment passed their security review with no exceptions, and the eval harness means their team can keep verifying quality as models change.
100%
On-prem, zero egress
~35%
Faster PR cycles
0
Compliance exceptions
Related reading: Running AI fully on-prem
The economics
Own it once. Stop paying per seat.
Per-seat SaaS copilots charge you every month, for every developer, forever, and still route your code through a third-party API. The Ativos Coding Agent is built once, deployed on your infrastructure, and yours.
| Per-seat SaaS copilots | Ativos Coding Agent | |
|---|---|---|
| Pricing model | Per-seat subscription, paid forever | One build cost + your infra. No per-seat tax. |
| Where code goes | Leaves your network to a vendor API | Nowhere. Runs inside your perimeter. |
| Model choice | Whatever the vendor serves | Your choice of open-weight model, swappable. |
| Marginal cost | Scales with headcount and usage tiers | Your compute cost only. Add devs for free. |
| Auditability | Vendor logs, if any | Full local audit trail you own. |
| Vendor lock-in | High. Lose the sub, lose the tool | None. You own the system and can fork it. |
See it on your codebase
We pilot on a shadow repo first: the agent works, your team reviews, nobody's code changes until you say so.
Book a call