AI on your terms

Harrow Port Authority's operations installation has no hosted AI provider at all. It has no route to the internet, so every model it uses runs on graphics cards in its own machine room: a Qwen3-32B for most work, with a Llama 3.3 70B and a Gemma 3 27B beside it. When Aoife Brennan, Harrow's head of IT, opens the AI switchboard page, it lists exactly those models, which job each one does, and the place every call is allowed to go. That place is the building.

Most organisations will mix hosted and local models. The principle doesn't change: the organisation decides which artificial intelligence (AI) it uses, where its data may travel and how much it spends, and Nexus enforces those decisions on every call.

The key belongs to the organisation

When an organisation uses a hosted model, it brings its own key. Nexus keeps keys in the organisation's AI pool. They belong to the organisation rather than to any person in it. Owners and admins add and withdraw them. The pool takes keys for Anthropic, Google Gemini, OpenRouter and Scaleway, and it can point at any server the organisation runs that speaks the common OpenAI-compatible protocol.

A key is typed in once. Nexus encrypts it on arrival and never shows it again, anywhere. From then on the key appears only as a short hint and a line such as "set by Aoife on 3 Sept". When a key is withdrawn, the switchboard stops sending calls to it at once, and the key stays listed as withdrawn, so the history of who used what holds together. Nothing is deleted.

Each organisation has its own provider account and its own bill. There's no shared Adverant key sitting behind a tenant's AI, so one organisation's spending never mixes with another's, and an organisation that changes provider simply withdraws one key and adds another.

Keys for outside data sources are kept apart from model keys. Harrow holds a key for the ship positions feed it reads, for example, on a separate page of external data keys. That page refuses a model key outright, because model keys belong in the pool and nowhere else.

The switchboard routes every call

Apps and agents in Nexus never call a model directly, and neither do workflows. They ask the AI switchboard. It owns the keys and makes the final choice of provider and model. An app can say what it would like, perhaps a fast model for short replies, and the switchboard honours that wish when the organisation has that provider set up. When it hasn't, the switchboard picks another the organisation did allow. An app can never force a model the organisation hasn't chosen.

Before a call leaves, the app labels it with the unit and role asking, and with how sensitive the data is. The switchboard routes on that label and never opens the call itself. It makes four decisions.

The first is the job. Reading a scanned form suits a different model from drafting a letter, so the organisation maps each kind of job (default, fast, reasoning, code and long context) to the models it prefers. The second is the data. Personal or secret data can be held to models on the organisation's own hardware, while public material may use more. The third is the place. Calls go only to the regions and providers the unit allows, and a call that would leave for anywhere else is refused, with the refusal written to the record. The fourth is the fallback. If a model is slow or down, the next allowed model takes the call. A key that fails rests for 60 seconds and is skipped; after five failures in a row it's switched off. The call reaches an allowed model or waits, and if neither works it fails with a clear reason. It never goes somewhere the rules forbid.

Rules start at the organisation and can be narrowed for each unit and app, and for each kind of data. A unit can be held to local models on its own hardware while another uses a hosted model in the European Union. A unit can never be looser than the organisation.

The AI switchboard

Every call is counted, never read

The switchboard counts every call by person and team, and by app and day. It measures each call's time and cost too. It never stores or reads what was asked or what came back. Each budget has a named owner and a limit. Budgets can be set at four levels, from the organisation down to one person, with units and skills in between. When a budget is reached, the rule its owner chose applies. The work can carry on or move to a cheaper model, or it can stop until an administrator agrees. Finance gets one statement that covers hosted and local models alike.

Models on your own servers

Any model the organisation runs on its own hardware can join the switchboard, as long as it speaks the OpenAI-compatible protocol. Your IT team gives the switchboard the server's address, sees the models it found, and chooses which job each one does. The connection page confirms "Nothing leaves this site" once it's done. A small model that turns text into searchable form also runs inside the installation by default, on ordinary processors, so search itself needs no outside service. Using a hosted service for that is a choice the organisation can make.

On an air-gapped site like Harrow, local models are the only models. That works well for most of what people do, and it brings one honest limit: a capability needs its model installed on site. Harrow's notebook studio can make slides and one-page summaries from the local models, but an audio summary needs a voice model, and until one is installed the studio says so plainly and names who can add it.

Studio on an air-gapped site

Local models can also check each other. At Harrow, work done by one model family is reviewed by another (Qwen3-32B by Llama 3.3 70B, for instance), so a blind spot in one family isn't checked by the same family.

For organisations that want to go further, the Model factory add-on trains and tunes models on the organisation's own graphics cards, using only data the organisation is allowed to use.

No key means no AI, and Nexus says so

An organisation with no model connected gets no AI answers. That's a deliberate limit of the design, not a fault. Nexus doesn't quietly borrow a shared key to fill the gap, because then the organisation's data would go somewhere it never chose.

What people see instead is a plain plate. The assistant explains that it can't answer because no model is connected, gives the code MODEL_NOT_CONNECTED in small type, and offers "Connect a model" to whoever can. Jobs waiting for a model run as soon as one is back.

Nothing goes to Adverant behind your back

A self-hosted Nexus doesn't report on your people to Adverant. When something does leave, you read it before you send it.

An installation on your own infrastructure prepares a yearly usage statement holding counters only: how many seats and devices are in use, and which feature groups. Your administrator reads it line by line before uploading it or carrying it out on a disk. An air-gapped site asking for a new feature sends a request file that names the installation and the feature, along with the installation's fingerprint. Nothing about people or their work goes with it. When you need help, a support bundle shows what it will collect and a preview of what's redacted before anything is sent.

Adverant staff can't look inside a customer installation on their own initiative. If support needs to, the request comes through a support case, and your administrator says yes or no. A yes is for a set time of eight hours at most and a named reach, such as engine logs. It never covers anyone's messages or files, or their mail and memory.

A person's own subscription is never the organisation's

Some people pay for an AI subscription themselves, such as a Claude Max plan. Nexus never treats that as the organisation's. A personal subscription can't be added to the organisation's pool (the pool refuses it by name), and no page that shows the organisation's AI set-up ever lists one.

The reasons are practical. A personal plan is bought under consumer terms for one person, so routing colleagues' work through it would break those terms. The organisation can't see its use or set a budget on it, and it walks out of the door when that person leaves. The organisation's AI should rest on keys the organisation owns, and in Nexus it does.