How Xinity Builds Genuinely Private AI Infrastructure

Most AI privacy is a promise. A data processing agreement, a compliance certificate, a paragraph in the terms of service assuring you that your prompts will not be used for training. You are asked to trust that the promise holds, and you have no way to verify it, because the infrastructure processing your data sits in someone else's building, under someone else's control, in someone else's jurisdiction.

We think privacy that depends on trust is not privacy. It is a contract. And contracts can change, be reinterpreted, or be overridden by laws you never agreed to.

Xinity is built on a different premise: your data cannot leak from infrastructure it never leaves. This post explains what that means in practice, down to the technical decisions that make it true.

Privacy by architecture, not by contract

The fundamental design principle of Xinity is zero mandatory data egress. Inference requests, responses, labels, model weights, and GPU telemetry all stay within your infrastructure by default. There is no analytics service collecting usage patterns, no external telemetry reporting back to us, and no external API call required for core operation.

The inference path is zero-egress out of the box. A fully air-gapped deployment additionally requires pointing the model catalog at a self-hosted Info Server, which takes one configuration change and is described in the exceptions section below. Once that is done, a Xinity deployment serving thousands of requests per day can run indefinitely without a single packet leaving your network.

That distinction matters because it changes who has to do the work. On a cloud platform, privacy is something you configure, monitor, and hope the provider honors. On Xinity, privacy is something you would have to actively undo.

What genuinely private looks like in practice

Claims are easy. Here is how the architecture enforces them.

Inference runs in an egress-blocked network. When Xinity runs vLLM in Docker, the containers operate on a network that blocks all outbound internet access. Models are pre-downloaded by the Xinity daemon and loaded offline. The process generating answers from your most sensitive documents is physically unable to phone home, because the network it lives on has no route out.

The whole stack is self-hostable. Gateway, dashboard, daemon, model catalog, database, cache: every component can run inside your walls. Organizations in strict zero-egress environments, from air-gapped research facilities to banking networks, can deploy everything locally and disable every optional outbound integration.

Your logs stay yours. Usage tracking, request logging, and data labeling pipelines write to your own PostgreSQL database. The audit trail that your compliance team needs exists, but it exists on your hardware, readable by your people, governed by your retention policies.

Encryption and authentication are enterprise-grade. The gateway supports TLS termination with your own certificates, inference nodes authenticate with per-node tokens, and access is governed by role-based access control across six roles and seven resource types. SSO via OIDC, passkeys, and TOTP two-factor authentication ship in the same codebase as everything else, no separate enterprise build, no bolted-on auth product. Which features are available on which license tier is disclosed below, because that belongs in the honest part.

Privacy you can audit, not just believe

There is one more difference between a promise and a property: a property can be inspected.

Xinity's core is open source under Apache 2.0, and the dashboard is source-available under the Elastic License 2.0. Either way, every line of code that touches your data is publicly inspectable. Your security team does not have to take our word for what the gateway logs, what the daemon transmits, or what happens to a request after it is answered. They can read the source, build it themselves, and verify that the running system matches the published code.

For regulated organizations, this changes the conversation with auditors. Instead of forwarding a vendor's compliance PDF, you can point to the actual mechanism: here is the code, here is our deployment, here is the network policy showing that inference has no outbound route.

The honest part: exceptions and licensing

Genuinely private also means genuinely transparent about the exceptions. Here is everything that can reach the internet, and everything that requires a license key.

The model catalog. If you do not host your own Info Server, the dashboard fetches model metadata, (names, specs, and driver strings), from an endpoint we host at sysinfo.xinity.ai. It is used solely for catalog data and never for inference or customer data. You can eliminate it entirely by pointing INFOSERVER_URL at a self-hosted catalog served from a local YAML file.

Web search. Operators can enable optional search integrations in the gateway's Responses API. These obviously require internet access to function. They are opt-in features and never part of the default inference path.

License-gated features. All of the code is inspectable, but some dashboard features activate only with a license key signed by Xinity: SSO, multi-organization support, the audit log, and the full set of roles. The free tier is capped at 120 GB of VRAM. The license check runs locally, activating a key does not open a data channel to us, and no inference or customer data is involved.

That is the complete list. We publish it because a privacy claim without its exceptions is marketing, and a privacy claim with its exceptions is engineering.

Why this matters more than ever

GDPR, banking secrecy, journalistic source protection, attorney-client privilege, and trade secret law make external data processing legally impossible for certain workloads. The organizations affected are not cloud-skeptical. They are sovereignty-blocked: they need modern AI capabilities and cannot lawfully send their data away to get them.

For them, the question is not whether a provider's privacy policy sounds reassuring. The question is whether the architecture makes the risk structurally difficult to the point of impossibility. That is the standard we build to.

Run AI where your data lives. Sovereign by architecture, not by contract.

Want to see what a zero-egress deployment looks like on your own hardware? Book a free 30-minute walkthrough with our team, or read the full technical architecture in the Xinity whitepaper.

This post was drafted with AI assistance and reviewed, fact-checked, and approved by the Xinity team.