All articlesSelf-Hosted Legal AI: What Your Team Controls
Caleto · October 17, 2026
Updated October 17, 2026
When a legal team asks for self-hosted AI, the first question should be: which parts of the system do we need to control? Running the application on your own infrastructure is one decision. Where a model processes a document, who can access it, and how copies are retained are separate decisions. A useful deployment conversation makes each of those boundaries visible.
Start with a map of the data
Follow one document through the proposed workflow: upload, storage, text extraction, search, model processing, review, and export. Then include the less visible copies: logs, backups, cached results, and support attachments. Ask who operates each service and which account owns it.
Self-managed application hosting can still involve external AI or OCR providers. A server in your cloud account does not, by itself, tell you where every processing step happens. Request a data-flow description for the configuration you intend to use.
Decide what your team will operate
Choose a named owner for the work that keeps the service running. A deployment that installs successfully still needs maintenance after the first week. Your operating plan should address:
Infrastructure capacity, network configuration, and access administration.
Software upgrades, dependency patches, and release testing.
Monitoring, incident response, and a route to vendor support.
Backups, restore exercises, retention, and secure deletion.
A small team may prefer a managed deployment if it cannot reliably cover those tasks. The right choice depends on operating capacity as well as control requirements.
Check access and model boundaries
Use a demonstration environment to test a few concrete scenarios. Can a user see a document from another matter? What happens when their account is removed? Can an administrator trace a failed request without copying confidential content into a support ticket?
Ask separately about model-provider credentials, permitted models, request logging, and provider retention terms. Capture the agreed configuration in your proposal rather than assuming that a deployment label answers these questions.
AWS, Azure, GCP, and on-premises
Deploy Caleto on AWS, Microsoft Azure, Google Cloud (GCP), or on-premises infrastructure with Self-Managed. Dedicated Cloud provides a private environment operated by Caleto. Infrastructure sizing, region, networking, and operating responsibilities are agreed for your deployment.
Proprietary and private model choices
Choose proprietary models such as GPT, Claude, and Gemini, or private models served through Ollama and compatible endpoints. Supported provider connections include Amazon Bedrock, Azure OpenAI in Microsoft Foundry (Azure AI Foundry), and Gemini on Google Vertex AI.
Your deployment operator configures provider access and available models. Model compatibility, regional availability, usage limits, and provider charges are confirmed during setup. Private hosting does not by itself make every AI or OCR request local; model and document-processing data flows are agreed separately.
Control still needs verification
Self-hosting is an operating choice, not a blanket assurance about security or compliance. NIST describes its AI Risk Management Framework as a voluntary resource for considering trustworthiness during the design, use, and evaluation of AI systems. That is a useful reminder to evaluate the complete workflow, not just the hosting address.
Source: NIST AI Risk Management Framework.
Where Caleto fits
Caleto offers a Self-Managed deployment discussion alongside Caleto Cloud and Dedicated Cloud. In the Self-Managed option, your team operates the infrastructure; software, support, setup, model connections, and usage allowances are scoped in the proposal. Infrastructure and external AI-provider costs are separate.
Bring your required hosting environment, likely users, document volumes, and security questions to a demo. These details help turn a general preference for self-hosting into an implementable plan.