GVP Institutions Compute Engine Pricing Support
Sovereign Compute Engine

Your institution's work
stays in your institution

Every request passes through the engine before it reaches any AI model. What identifies a person, an account or a case is removed first, and every crossing is recorded on your own record.

Talk to us See how it works
Your request Pay Mrs Adebisi Okonkwo, account 0123456789, ₦145,000 for the September allowance.
Inspect/Strip/Route/Log
What leaves Pay [PERSON_1], account [ACCOUNT_1], ₦145,000 for the September allowance.
What comes back Payment instruction drafted for Mrs Adebisi Okonkwo, account 0123456789, ₦145,000.
An illustration. Names and figures are examples.1

One request,
two journeys

Most AI tools send exactly what you type to a model, often abroad. The engine changes what leaves, without changing what you get back.

Without the engine

The request travels as it was written.

Names, account numbers and case references leave with it
Processed wherever the provider chooses
No record the institution can see
No way to keep sensitive work inside

The institution finds out what left only if something goes wrong.

With the engine

The request is checked before anything leaves.

Identifying details replaced before sending
Sent only where the institution allows
Every crossing on the institution's own record
Critical work can be kept on its own node

The work comes back complete, with the details restored.

Four gates,
on every request

Nothing in GVP or Institution OS reaches a model any other way. Tap a gate to see exactly what it does.

Your institution
sets the rules

Where work may go is decided by the institution, department by department. The engine enforces it on every request.

Where each department's work may go An illustration of the rules an institution sets. Departments and settings are examples.
AccountsOut to models, with identifying details removed
RevenueOut to models, with identifying details removed
PersonnelOwn compute node only. Stops if the node is unavailable
Director's officeOwn compute node only. Stops if the node is unavailable

With your own node,
nothing leaves

Add a Sovereign Compute Node and the engine routes work to the institution's own machine first. Where the node is required, work that cannot reach it stops.

Every request4 gates

Checked before it moves

Inspected, stripped, routed and logged, whatever the destination.

Sent outside0 identifiers

Nothing that names anyone

Names, accounts and references are replaced before anything leaves.2

Recorded1 record

And it is yours

What crossed, when and where, on the institution's own record.

The Sovereign Compute Node

Stated plainly

If it cannot be made safe, it does not leave. Where something looks like an identifier that cannot be safely replaced, the request is stopped and nothing is sent.
The figures are never changed. Amounts, dates and totals travel as they are, so the work comes back correct.
We record that work happened, never what it said. Our own view holds when, where and how much was removed. The content stays yours.
It adds to your security. It does not replace it. The engine reduces what leaves. The institution's own controls, devices and people still matter.2
Screens in a monitoring room.

Included,
never sold separately

There is nothing extra to buy or procure. The engine sits under everything we make.

In GVP

For every officer, on every plan

Included

From the free plan upwards, every request passes through the engine.

About GVP
  • All four gates on every request
  • Identifying details removed before sending
  • Every crossing recorded

In Institution OS

For the whole organisation

Included

With rules set department by department, and routing to your own node.

About Institution OS
  • The institution's own rules, enforced
  • The full record, on your own dashboard
  • Routing to a Sovereign Compute Node

Before you decide

Which AI models does the engine send to?

The engine works with models from several leading providers. Each receives only text with identifying details removed. The current list, and where each processes data, is set out in your institution's agreement and available on request.3

What counts as identifying?

Details that point to a person or a case: names, account and phone numbers, identity numbers, addresses and references. Where the engine is unsure, it treats a detail as identifying.

Does removing details make the work worse?

No. The model works with placeholders, the figures are untouched, and the details are put back when the work returns, so what you receive is complete.

Can we see the record?

Yes. It is the institution's own record. In Institution OS it sits on the dashboard, and the head of the institution decides who else can see it.

Do we need our own compute node?

No. The engine protects work from the first day. A node is for work that must never leave the building at all.

Your institution's work, in your institution

Start with a conversation about where your work goes today.

Talk to us