Product · CloudNerve
Private AI Workspace
An EU-only AI assistant for your staff, grounded in your documents, in your AWS account.
A ready-to-run assistant that you deploy in your own AWS account: Amazon Bedrock models restricted to the EU, answers grounded in company documents, sign-in with your identity provider, an audit trail and a hard monthly cost cap.
Who it's for
EU organisations that want a chat assistant on company documents without sending them to a service outside their control, including teams moving off Amazon Q Business.
When teams call us
Staff pasting company documents into public chatbots, an Amazon Q Business plan that is closed to new customers, or a security team that needs an audit trail before approving AI.
What it does
Inside Private AI Workspace
EU-only models
While the EU-only switch is on, the app refuses to start with a non-EU model, and IAM allows EU models only.
Answers with sources
Every answer lists its sources. With nothing relevant found, it says it does not know.
Access control
Personal and team spaces; each user only retrieves from the spaces their groups allow.
Your sign-in
Microsoft Entra ID, Google Workspace or Okta through Amazon Cognito, with admin, member and auditor roles.
Protection on every call
Amazon Bedrock Guardrails and NerveGuard on the prompt, the answer and every retrieved passage.
Audit log
Sign-ins, admin changes, model calls and exports, kept under S3 Object Lock; auditors search and export it.
Monthly cost cap
Admins are notified at 80% and new requests are blocked at 100%.
Three languages
English, Finnish and Swedish interface.
What you receive
On every run
- A CloudFormation template for the whole workspace
- The web app with chat, history, citations and document upload
- Admin pages for models, users and roles, the cost cap and audit export
- A CloudWatch dashboard, alarms and a health check
- A runbook for deploy, upgrade, rollback, key rotation and uninstall
How it works
Step by step
- 01
Deploy one stack
Deploy into a new or existing VPC, with your domain and certificate. The load balancer is internal by default.
- 02
Connect sign-in
Connect sign-in to your identity provider and map your groups to roles.
- 03
Add documents
Add documents to team spaces; staff can upload to their personal space.
- 04
Roll out to staff
Roll out with models, cost cap and retention set by your admins.
Built on AWS
The AWS services it uses
- Amazon Bedrock
- Amazon Bedrock Knowledge Bases
- Amazon S3 Vectors
- Amazon Bedrock Guardrails
- Amazon ECS on AWS Fargate
- Application Load Balancer
- AWS WAF
- Amazon Cognito
- Amazon DynamoDB
- Amazon Data Firehose
- Amazon S3 Object Lock
- AWS KMS
Your data
Everything runs and stays in your AWS account, encrypted with your key. Prompt and answer text is logged only if an admin turns content logging on. You pay AWS directly for usage. Nothing is sent to CloudNerve.
Scope, stated plainly
What it does not do
- Train or fine-tune models
- Use model providers outside Amazon Bedrock
- Connect to SharePoint, Confluence or Google Drive yet; documents are uploaded
- Make your organisation compliant with any regulation; it supplies evidence and controls
Questions
Common questions
- Which models can we use?
- The ones your admins allow. With the EU-only switch on, only EU inference profiles and models in an EU Region are accepted.
- What does it cost to run?
- You pay AWS for the infrastructure and Bedrock usage in your account; the cost cap limits model spend each month.
- Can it stay off the internet?
- Yes. The default is an internal load balancer reachable only from your network.
See Private AI Workspace on your own AWS data.
Book a free Intro Call with a CloudNerve architect, or ask us anything about how it would fit your accounts.