Your people already use AI. The question is whose servers it runs on.

A private AI workspace is a private AI platform with a ChatGPT-class chat experience, deployed entirely on your own infrastructure — on-premise, in a private cloud, or in an in-country sovereign cloud — so prompts, documents, and model outputs never leave your jurisdiction or control. Sphere Private AI Workspace adds the enterprise layer: SSO, role-based access control, configurable guardrails, prompt-injection detection, and a complete audit trail of every interaction.

Yes. The Workspace runs containerized on Docker and Kubernetes in your data center or approved sovereign cloud, serves open models such as Qwen and Llama on vLLM (or frontier models via private endpoints), and meets banking requirements: TLS 1.3 in transit, AES-256 at rest, Entra ID SSO over SAML 2.0/OIDC, maker-checker patterns, exportable audit logs, penetration-test reports, and source-code escrow.

Yes — natively, not as an afterthought. Full Arabic and English interface with right-to-left (RTL) layout, automatic language detection, bilingual retrieval-augmented generation over Arabic and English documents, and Arabic/English speech-to-text voice input.

A typical deployment reaches production in 8–12 weeks: weeks 1–2 for diagnostic and architecture, weeks 3–8 for deployment and hardening including penetration testing, and weeks 9–12 for pilot launch, hands-on admin training, and full documentation and source-code handover.

You do. Sphere delivers full source code, deployment scripts, architecture and operations documentation, and hands-on knowledge transfer at project completion — with escrow arrangements available where procurement requires them.

The model layer is agnostic by design: open-weight models such as Qwen and Llama served on vLLM inside your environment, or frontier models accessed through private cloud endpoints. Administrators switch between model versions and sizes per use case, and upgrades deploy without downtime.

Governance is enforced at three layers: configurable guardrails on inputs and outputs, domain restriction of responses, detection of sensitive-data uploads such as payment-card information, and real-time admin notifications when policy boundaries or injection attempts are detected. Every event lands in the central audit database — exportable for your compliance team.

Yes — native federation with Microsoft Entra ID, Okta, Ping, or any SAML 2.0 / OAuth 2.0 / OIDC identity provider. For regulated buyers this is typically the first gate a vendor has to clear: no shadow identity system, no separate login to manage. If SSO isn’t day-one, most procurement teams won’t evaluate the rest of the proposal.

Every authentication event, prompt, AI-generated response, file upload and download, session detail, and admin change — timestamped, attributable to a specific user, and exportable for your compliance and regulatory reporting. This is the single most-cited requirement across regulated-industry AI RFPs, and it’s asked twice in most of them: once functionally, once at the infrastructure level. We answer both the same way.

Yes, and we’ll name the specific facility. Data residency is usually the requirement that determines whether a vendor is even eligible to bid — a vague answer like "we support cloud deployment" doesn’t clear that bar. The Workspace deploys on-premise, in your private cloud, or in a named in-country/in-region sovereign cloud, aligned to your jurisdiction’s specific data protection law.

Yes — regulated buyers weight peer references (same industry, same region, comparable data-residency constraints) far more heavily than a general enterprise client list, and we answer accordingly with implementation case studies from comparable institutions rather than logo-count.