Straight answers about sovereign AI.

Yes. Every Island Mountain system is designed to operate completely air-gapped. The models, the inference engine (vLLM and Ollama), and the interface (OpenWebUI) all run locally. Once the system is set up and models are loaded, you can disconnect the ethernet cable entirely and everything still works.

Users reach the system through a web browser on your local network. As long as the device and the server share a network, even an isolated one with no internet, inference runs normally. No phone-home. No license checks. No cloud dependencies. The only things that ever need internet are downloading new models and applying OS security updates, both optional and on your schedule.

Island Mountain applies a documented air-gap configuration before delivery, disabling every outbound feature at the environment-variable level, and confirms it before shipping. Your IT team can independently verify every setting on the delivered system.

It starts with us on-site, watching your people work, before anything gets specced. We sit with the staff who run the workflow: the senior paralegal who knows which intake questions matter, the records clerk who can tell you which form gets filled out wrong every time, the compliance officer who knows where the real risk lives. We learn the work the way they run it, not the way the SOP describes it, and fill in the gaps in conversation.

That study becomes a system design. Only then does hardware enter the picture, sized to what we found. After the build we hand it off and train your team, because a deployment that leaves behind people who understand the thing is the one still running a year later. The full method is on the Forward Deployed page.

Long enough to understand the work, which depends entirely on how tangled it is. A single-department workflow is a short engagement. An organization with a dozen handoffs between departments takes longer, and we would rather tell you that than quote you a tidy number that turns out to be fiction.

Who we need is more important than how long. Not a steering committee: the people who do the job, for enough hours that we see the exceptions and not just the happy path. Those hours pay for themselves several times over, and they are the first thing organizations try to cut.

We would rather tell you now than after a serious capital purchase. If your organization needs the absolute latest proprietary models (GPT-4o, Claude Opus, Gemini Ultra) on release day, local hardware will not deliver that; open-source closes the gap over time, but there is always a gap.

If your data is not sensitive and cloud AI is working fine for a handful of casual users, the sovereignty story may not justify owning infrastructure. And if your organization has no IT capability at all and cannot rack or maintain a server, know that after the included 30-day setup support your team owns the day-to-day, though ongoing support retainers are available.

Where local hardware earns its place is exactly where cloud creates exposure: regulated data, privileged data, sovereign data, and agentic workflows that must be governed and audited. If that is you, the rest of this page is written for you.

Running AI on local hardware eliminates the data-transmission vector that creates HIPAA exposure in the first place. With a cloud service, Protected Health Information (PHI) leaves your network and is processed on shared infrastructure controlled by a third party. Under 45 CFR §164.402, that transmission can constitute a reportable disclosure event. With local inference, PHI never leaves your premises, and there is no business associate to sign a BAA with because none is involved.

Local hardware does not by itself make your entire workflow HIPAA-compliant. You still need access controls, audit logging, encryption at rest, and staff training. The hardware removes the cloud transmission risk, the fabric supplies the audit trail, and your organization owns the rest. Island Mountain is not a compliance attorney and does not certify HIPAA compliance. See our Medical Practices page for how this fits a clinical program.

The core issue with cloud AI for law firms is this: client data sent to a third-party API is data disclosed to a third party. Under ABA Model Rule 1.6, attorneys have a duty to make reasonable efforts to prevent unauthorized disclosure of client information, and courts have found privilege waived when confidential information is processed through systems outside the firm's control.

Local AI keeps every prompt, document, and response on a server inside your office, behind your firewall, on hardware you own. Your firm still needs internal policies on who accesses the system, what data goes in, and how outputs are treated in work product, but the fundamental architectural risk of third-party disclosure is removed. See our Law Firms page for more.

Yes. It is one of the primary use cases Island Mountain hardware is built for. Tribal nations exercise inherent sovereignty over constituent data, enrollment records, health information, and governance documents. Routing that data through cloud AI means processing sovereign data through jurisdictions and infrastructure outside tribal authority.

Local AI keeps everything on tribal premises, under tribal law, processed by hardware the nation owns outright. No data leaves the reservation, no cloud terms of service apply, and no federal or state jurisdiction touches the processing. The pre-installed models carry permissive open-source licenses, so the nation owns them with no usage restrictions, and the system runs fully air-gapped if your posture requires it. See our Tribal Nations page for OCAP-aligned workflows.

ITAR restricts processing and storage of controlled technical data to environments that prevent foreign access. Cloud infrastructure with multinational operations, overseas data centers, or foreign-national employees creates structural compliance risk. Hardware you own, operate on US soil, and control with US-person-only access removes the cloud processing vector entirely.

The open-weight models are not themselves ITAR-controlled; your data is the controlled element, and local hardware keeps it off infrastructure you do not control. Island Mountain does not provide ITAR or CMMC certification. That compliance covers physical security, personnel screening, access controls, and documentation well beyond the hardware, and the Woven Security & Governance Fabric supplies the audit evidence that supports it. See our Defense Contractors page for CUI, CMMC, and DFARS workflows.

The safety question usually comes from two concerns: the model's origin and data handling. Here are the facts.

DeepSeek V4-Flash is an open-weights model released under the MIT license. When you run it on Island Mountain hardware, it executes entirely on your local GPUs. No data is sent to DeepSeek, to any Chinese server, or to any external endpoint. The weights are publicly available and independently audited by the open-source community. The model does not phone home and cannot: it is a file on your drive being processed by your GPUs.

The risk with DeepSeek exists only when you use its cloud API, which routes your data through their servers. That is not how Island Mountain systems work; ours run the model locally, air-gapped if you want, with zero external communication. Treat it like any other software asset: verify the download hash, apply your acceptable-use policy, and run it on infrastructure you control.

Pricing is scoped to your workload and headcount, and every number comes from a conversation, not a configurator. You tell us what you are running, how many people need access, and which models matter; we spec the right system and put a written quote in front of you.

Each build is a one-time hardware purchase with no subscription fees, no per-token charges, and no recurring software licensing. The models are open-source, OpenWebUI is open-source, and the operating system is Ubuntu Server LTS. There is no public price list because sizing sovereign infrastructure is a human decision, not a shopping-cart line item. Talk to the builder to get a number, or call 1-341-441-8740.

It starts with a scoping call, then time on-site with your people, then a written quote scoped to what we found. We do not spec speculatively. Once the design is agreed, that triggers sourcing of your specific GPUs and components through authorized NVIDIA channels with full procurement documentation. Terms are handled directly, human to human, no automated checkout.

Hardware lead time runs roughly 3 to 5 weeks, longer when the build calls for parts sourced per order. That clock overlaps the workflow study rather than following it, so the schedule is usually set by how quickly we can get the right hours with the right people, not by shipping. The system is configured and air-gapped before it lands, so once it is racked and powered (208V/30A) most organizations run their first real prompts the same day. Every deployment includes 30 days of hands-on support with direct access to the engineer who built it.

Every system ships with a 1-year hardware warranty covering all components, including GPUs, CPU, RAM, storage drives, and power supplies. If a component fails within the first year, we handle the replacement.

GPU failures are managed through supplier RMA agreements with documented replacement timelines, and we hold a 20% warranty reserve per unit so replacements are not waiting on budget. You contact the builder directly (phone 1-341-441-8740 or email), we diagnose remotely, and we ship the part or arrange a swap. Extended warranty options are available at the time of purchase, and after warranty, support is available per incident or on an annual retainer.

This is a fair question, and you should ask it. Island Mountain is founded by Basho Parks, who hand-builds each rack. The company is new; the team is not.

Whatever a deployment lands on, it's standard enterprise hardware bought through authorized channels with established supplier RMA agreements, backed by a 1-year warranty and a 20% warranty reserve per unit. Nothing exotic, nothing single-sourced, nothing you'd have trouble replacing. The software is entirely open-source, so nothing is proprietary and nothing is locked.

If Island Mountain closed, your system would keep running. Ubuntu Server LTS, vLLM, Ollama, OpenWebUI, and open-weight models depend on none of our servers. You would lose our support and warranty, but the system needs no license, no activation, and no connection to us. OS updates come from Ubuntu, drivers from NVIDIA, models from public libraries, and any competent Linux administrator can maintain it. Vendor independence is exactly the problem we are solving.

Not on day one, but within weeks to months, yes. Cloud providers ship proprietary models the moment they control the infrastructure. Open-source models lag that cycle, so when a new flagship launches you will not have an equivalent on your local hardware that afternoon.

What has happened consistently is that open-weight models close the gap fast. DeepSeek V4-Flash, Llama 4 Scout, and DeepSeek R1 all reached or exceeded the proprietary models they followed within weeks to months. Your system can run any new open-source model that fits its VRAM: you download it through Ollama or OpenWebUI, with no hardware change. And because every deployment is built with room to grow, you add capacity as your needs grow instead of starting over.

You can, and if you are a developer running experiments, you probably should. The guides exist and the software stack is the same: Ollama, vLLM, OpenWebUI, and open-weight models like DeepSeek V4-Flash and Llama 4 Scout. With the staff to build, configure, test, and maintain it, a DIY box will run inference.

Here is what a DIY build does not include. Professional procurement documentation: every accelerator in a deployment has a documented chain, purchase receipts from authorized channels, a serial-number registry, and RMA history, which consumer cards from Amazon or Newegg do not carry. Professional RMA chains that keep replacement parts inside the same documentation trail, which matters for HIPAA, ITAR/DFARS, and CMMC audits. Direct builder support: you talk to the person who assembled your system, not a ticket queue.

The honest answer: if you are experimenting, build your own. If you are a regulated organization putting AI into production where provenance and evidence matter, that is what the difference covers.

Yes, and it's public. The Island Mountain Doctrine is the company's point of view written down before we knocked on anyone's door: the chain of command (technology serves people, people serve missions, missions serve communities, communities preserve civilization), the seven-phase method behind every engagement, the security posture, and the 28 principles a deployment answers to. It's versioned like an engineering document, revised in the open, and silent edits never happen.

Read the full text: The Island Mountain Doctrine.