Internal meeting transcripts and minutes
From an authorised recording, a transcript and draft minutes, produced locally.
Read the example →Sovereign AI
Sovereign AI: models run on the infrastructure you choose
For data you do not want to entrust to any external AI provider. Bestlog deploys models on your infrastructure or on GPU servers located in Europe, and integrates them with your applications.
When to choose it
When sovereign AI is the right call
- The data is covered by professional secrecy or a contractual confidentiality obligation.
- Your internal policy prohibits sending certain data to an external AI service.
- You want control over the model version and the timing of its updates.
- The processing volume is regular and predictable.
The trade-off, stated plainly
Open-weight models that can be deployed on your premises do not always match the best models available through an API. We test quality on your task before recommending this architecture. If the gap is too wide, protected external AI may be the right answer.
Use cases
Examples suited to this architecture
Examples of possible pilots, assessed on your processes and your data.
Flagging unusual journal entries
From an accounting export, a prioritised list of atypical entries with an explanation.
Read the example →Supplier invoice coding
A suggested ledger account and VAT code, with a rationale, validated by a person.
Read the example →Architecture
Two deployment locations
On your infrastructure
In your data centre or private cloud. GPU requirements depend on the chosen models and the volume. Your teams stay in charge of operations; Bestlog steps in as set out in the contract.
On European GPU servers
Dedicated GPU servers located in Europe. The provider and hosting location are chosen with you; a data processing agreement (GDPR Article 28) is required in all cases.
The building blocks of an installation
Models
Chosen for the task (text, speech, documents) and for a licence compatible with your use, checked case by case.
Inference service
Exposed only on your network, through an internal API.
Access gateway
Authentication through your directory or SSO, permissions per application and per user.
Integration
Connection to business applications, with human validation in the interface where needed.
Security and logging
Know who uses what, and be able to prove it
- Network isolation: the inference service is not exposed to the Internet.
- Centralised authentication and role-based permissions.
- Call logging: who, when, which application, which model and which version. Request content is kept only if you decide so, for a defined period.
- Encryption of data in transit and at rest, according to your security policy.
- Model updates planned, tested and then deployed: no change in behaviour without your decision.
- Monitoring and recovery procedure agreed with your operations team.
GDPR and AI Act
GDPR: hosting alone does not make you compliant
Keeping data on your infrastructure or in Europe limits transfers and simplifies the analysis. It is not enough: legal basis, data minimisation, retention periods, information to data subjects, security and, where required, a data protection impact assessment (DPIA) still need to be addressed.
We provide the technical documentation your DPO needs: data flows, hosting locations, logging, security measures.
AI Act: obligations depend on the system
The AI Act transparency obligations (Article 50) have applied since 2 August 2026, with transitional provisions for certain generative systems placed on the market before that date. Obligations for high-risk systems listed in Annex III apply from 2 December 2027; those for systems embedded in products covered by Annex I, from 2 August 2028. The obligations that actually apply depend on the nature of the system, how it is used, and your organisation's role (provider, deployer…).
The same model can fall under different regimes depending on how it is used. The flash audit identifies the questions to be examined; the legal qualification remains that of your organisation and its advisers.
Frequently asked questions
Before you start
Do we need to buy GPU servers?
Not necessarily. Depending on model size and volume, the installation can run on your existing hardware, on dedicated GPU servers in Europe, or on a server to be purchased. Sizing is based on tests on your task.
Are the models as good as those from the major providers?
Not always. For some tasks the gap can be small; for others it remains real. We measure it on your data before recommending an architecture.
Who operates the solution?
Your teams, Bestlog, or both, depending on the contract. The split of roles is written down at the scoping stage.
How long until a first result?
A POC takes 2 to 4 weeks, depending on the agreed scope, data availability and technical prerequisites.
Explore an AI use case for your organisation
A first conversation to clarify the process, the data and the constraints.