Private vs Hosted
Choose where your gateway runs and where your LLMs run. These are separate decisions: running a private gateway does not make an external model API private. You can deploy Cortega on your own hardware or in your own cloud account, or use a Cortega-hosted service.
Compare the options
| Option | Where the gateway runs | Where inference runs | What you operate |
|---|---|---|---|
| Private: LLMs + gateway | Infrastructure you control | Your own model hosts | Cortega, model serving, hardware capacity, upgrades, and data stores |
| Private: gateway only | Infrastructure you control | External model providers | Cortega and its data stores; providers operate inference |
| Hosted | Cortega's shared platform, with tenant separation | Hosted model services | Client configuration, access policies, and usage; Cortega operates the platform |
Dedicated is an operating arrangement for a private environment: Cortega operates an environment in your cloud account with its own gateways, database, and URL. Agree separately where models run. A dedicated gateway alone does not mean private inference.
Private: LLMs and gateway
Run AIBG and your model servers inside your chosen infrastructure boundary. That can be a personal machine, servers you own, or compute in your cloud account. Inference requests go from your tools through your gateway to your models, without requiring an external model API.
Start with Model Intelligence to select models and size hardware. Use Ollama for a local setup or the packaged self-hosted LLM scripts for a supported vLLM deployment. Download and extract the Cortega install package to set up both the platform and self-hosted LLMs. Follow Build your private AI infrastructure.
You control model availability, capacity, upgrades, network access, and the location of gateway data. Account for GPU costs and test the models against your tools' API, streaming, and tool-calling requirements. Keep fallback routes private too. Agent tools, telemetry, logs, and auxiliary AI features need their own review; private inference alone does not establish an air-gapped system.
Private: gateway only
Run AIBG and its data stores on infrastructure you control, while sending inference requests to external providers. This gives you a central place for credentials, model access, budgets, routing, guardrails, and observability without operating model servers or GPUs.
Your gateway's records stay in the stores you configure, but prompts and responses cross the boundary to the selected model provider. Provider data handling, retention, and regional settings still matter. This option fits teams that want private governance infrastructure while using externally hosted models; it does not meet a requirement that all inference stay on your own infrastructure.
Use the installation guides, then configure providers and models using the user guide. You can also mix private and external models, but the privacy boundary then depends on each request's route and any fallback it permits.
Hosted
Cortega operates the shared platform at live.cortega.ai. Your organization has its own tenant and usage view. You configure access and policies without deploying or upgrading the gateway infrastructure yourself.
Choose this when reducing operational work matters more than running the platform inside your own infrastructure. Review the service's data handling and model arrangements against your requirements before choosing it for sensitive workloads.
Dedicated operation
For a private environment operated by Cortega, use Dedicated: an environment inside your own cloud account with separate gateways, database, and URL. This avoids shared platform infrastructure while delegating platform operations.
Specify whether you need LLMs + gateway private or gateway private with external model APIs. Model hosting, network connectivity, maintenance, and data access must match that choice; the word “Dedicated” does not decide them.
How to decide
| Your requirement | Start with | Check before committing |
|---|---|---|
| Inference and gateway data must stay on infrastructure you control | Private: LLMs + gateway | Model quality, hardware capacity, private fallback routes, and external tool dependencies |
| Keep gateway operations and records private while using external model APIs | Private: gateway only | Provider data handling, network paths, and which content leaves your boundary |
| Use existing GPUs or purchase hardware for your models | Private: LLMs + gateway | ModelInt sizing, runtime compatibility, and expected concurrent usage |
| Avoid operating gateway infrastructure | Hosted | Service data handling, available models, and organizational requirements |
| Require a separate environment in your cloud account, operated by Cortega | Dedicated | Specify model location separately and agree on operational responsibilities |
| Minimize network latency between the gateway and your models | Private: LLMs + gateway, colocated | Measure the full client-to-model path and model performance under load |
| Use private models for sensitive tasks and external models for other work | Private gateway with mixed providers | Explicit team access, route selection, and fallback rules for each workload |
Gateway routing and failover are useful across deployment choices, but cannot guarantee capacity or bypass provider limits. A private-inference requirement also limits failover to approved private endpoints. See AIBG capabilities.
Connect assistants and govern device traffic
Endpoint Guard works alongside these deployment options. Its AI Assistants feature configures supported local tools to use AIBG with a per-device Cortega key. Where their inference goes then depends on the gateway's model routing. Follow the AI Assistants setup.
Separately, Apps policies observe, police, or block intercepted traffic to its original destination and report observations to your configured Cortega instance. Installing Endpoint Guard does not make external SaaS inference private. Review capture settings, reporting, and other client connections as part of the same data-boundary decision.
Get started
For both models and gateway under your control, follow Build your private AI infrastructure. For a private gateway, choose an installation path; the local quickstart is useful for evaluation. For hosted operation, start at Cortega.AI.
Multi-tenancy is independent of these hosting choices. A private customer-managed installation can serve multiple tenants. See On-prem multi-tenant setup for the environment, URL and enrollment contract.