For Government
AI for government, kept inside the perimeter you already defend
Uthereal builds AI systems for public agencies on infrastructure the agency controls. Your documents stay in your jurisdiction, your team holds the keys, and every token that crosses the boundary is counted before it leaves.
The problem
Most public sector AI projects fail on the same three points
Agencies rarely stall because the technology does not work. They stall because nobody can answer the questions the security officer, the data protection officer and the finance committee ask on the same afternoon.
Where does the data actually go?
A demo that works in a browser is often sending citizen records to a server in another country under another legal system.
What happens when the contract ends?
If the prompts, the tuned behaviour and the knowledge base live in a vendor account, the agency has rented a capability rather than built one.
Who can prove what left the building?
Most teams can show a cost dashboard. Very few can show a security officer exactly which text crossed the boundary last Tuesday.
We build for those three questions first. The useful AI comes after, and it comes faster because the security review does not restart every quarter.
Sovereignty
Sovereignty is six specific things, not a slogan
The word is used loosely. When an agency puts it in a tender, it usually means some combination of the points below. We recommend writing all six into the requirement, because a supplier can satisfy one and fail the rest.
- Data residency
- Documents, embeddings, prompts, answers and backups sit in named data centres inside your territory. Embeddings count. They are derived from the source text and should be treated as the source text.
- Legal jurisdiction
- The operating company, and any parent that can be compelled to hand over data, sits under law you accept. Physical location alone does not settle this.
- Model control
- You know which model version answered which question, and it does not change without your approval. Open weight models run on your hardware. Hosted models are pinned and logged.
- Key custody
- Encryption keys live in your key management system or hardware security module. The supplier cannot decrypt your content, even under instruction.
- Operational control
- Your staff can stop the system, revoke access, and read the logs without opening a support ticket.
- Exit rights
- On the last day of the contract you keep the knowledge base, the configuration, the evaluation sets and the agents themselves in a format you can run. This is the part most agencies forget to ask for.
01
02
03
04
05
06
Own the loop, not the model. The model will be replaced within two years. The knowledge, the workflows and the evaluations are what your agency should still hold in ten.
Architecture
Three ways to deploy, chosen by the sensitivity of the work
There is no single right answer for a ministry. A licensing office and an intelligence unit have different needs, and forcing both into one pattern makes one of them either unsafe or unusable. We normally run all three patterns in the same organisation, separated by data classification.
Pattern A
Closed on-premise
For classified material, criminal justice records, health data and anything where the answer to “may this leave the site” is no. Everything runs on agency hardware. There is no outbound path to a model provider, and updates arrive through a controlled transfer process.
- No outbound path
- Agency GPUs
- Offline updates
Swipe to see the full diagram →
Pattern B
Sovereign cloud tenant
For material that is sensitive but not classified, where the agency wants elasticity, managed hardware and faster access to newer models. The system runs in an in-country region, in a tenant the agency owns, with customer managed keys and zero data retention agreed in writing with the provider.
- In-country tenant
- Your keys
- TokenWatch on egress
Swipe to see the full diagram →
Pattern C
Hybrid split by classification
The pattern most agencies end up with. Sensitive work stays on-premise. General work uses cloud services where they are genuinely better, such as translation, transcription and long context reasoning on public documents. The split is enforced at a gateway rather than by asking staff to remember which tool to open.
- Classification gateway
- Inline redaction
- Per-zone policy
Swipe to see the full diagram →
Security
Built to pass the review your security team already runs
Agencies do not need a new security model for AI. They need AI that fits the model they already accredited. We design to the controls your team uses, and we produce the evidence in the format your accreditation process expects.
- Identity
- Access comes from your directory over SAML or OIDC. Group membership drives what a user can retrieve. There is no separate user list to maintain, and leaving staff lose access when the directory says so.
- Network
- Deployment sits inside your zone model. No inbound connections from outside. Outbound traffic, if any, goes through an allowlist and through TokenWatch.
- Classification handling
- Labels travel with the content from the source system into ingestion, retrieval and the answer. A restricted document does not become unrestricted because it was summarised.
- Audit
- Prompt, retrieved sources, model version, answer, user and time are written to an append-only record and shipped to your SIEM. An investigator can reconstruct any answer months later.
- Key management
- Customer managed keys held in your KMS or HSM. Uthereal has no decryption path.
- Supply chain
- Signed container images, a software bill of materials, pinned model versions and an offline update route for closed sites.
- Model behaviour
- Answers carry citations to source documents. The system declines rather than guesses when the knowledge base does not support an answer. Refusal rules and tone are configurable per department and are tested before release.
- Assurance
- Evaluation sets built from your own material, run before every change. Penetration testing and red teaming of prompt injection paths. Reports written for a security officer, not for a marketing page.
The architecture maps to ISO 27001 and NIST SP 800-53, follows the NIST AI Risk Management Framework, and is designed to support obligations under the EU AI Act for high risk systems, the GDPR, and the Swiss Federal Act on Data Protection. We will sit with your compliance team and work through the control mapping line by line rather than send a badge.
Uthereal Token Watch
Proof of what left, not a promise
Every AI deployment has a boundary somewhere. TokenWatch sits on the trust boundary and inspects every request before it crosses, replacing trust in a diagram with a measurement.
Meter
Counts tokens leaving, by user, by department, by destination and by classification. The count is the primary security number, not the billing number.
Classify
Inspects the outbound payload for personal data, case identifiers, protective markings and anything matching your own patterns. Detection happens before transmission, not in a report the next morning.
Enforce
Applies policy in line. Allow, redact and allow, or block and alert. Policies are written per zone and per classification, and a failed classification defaults to blocking.
Report
Produces a signed egress record your security officer can read and your auditor can test. Every entry links back to the request that produced it.
Egress record, sample
| time | user | dept | dest | cls | tok | action |
|---|---|---|---|---|---|---|
| 09:14:02 | m.brunner | licensing | translate.eu-ch | PUBLIC | 842 | allow |
| 09:14:40 | m.brunner | licensing | translate.eu-ch | PUBLIC | 611 | allow |
| 09:16:18 | a.keller | social | llm.eu-ch | INTERNAL | 1204 | allow, 3 fields redacted |
| 09:17:55 | a.keller | social | llm.eu-ch | RESTRICT | 0 | block, policy SOC-04 |
| 09:18:03 | system | social | siem.internal | - | - | alert raised, ticket 4471 |
| 09:22:31 | t.frei | justice | llm.eu-ch | RESTRICT | 0 | block, policy JUS-01 |
0
tokens out of the closed zone, 30 days
2
blocked attempts, both raised as tickets
100%
outbound calls with a classification decision on record
The blocked rows matter more than the allowed ones. They show the control is live rather than decorative.
- A closed deployment can be shown to be closed. The counter reads zero, and any number other than zero is an incident with a named user and a timestamp.
- Shadow AI use becomes visible. If a team starts sending case notes to an unapproved service through an approved network path, you see it the same day.
- Cost stops being a surprise. The same meter that protects data also caps spend per department.
- Accreditation gets easier. Instead of arguing about what could happen, you hand the assessor a record of what did.
How we start
How a deployment starts
We work in short, funded stages with a decision point at the end of each one. No stage depends on committing to the next. Timings below are typical for a department of a few hundred staff.
- 012 weeks
Scoping workshop
Two or three candidate use cases, chosen for value and for how bounded the data is. We classify the material with your data protection officer and write down what may never leave the site. You get a short paper naming the use cases, the data involved and the deployment pattern each one needs.
- 023 to 4 weeks
Architecture and control mapping
A reference architecture for your estate, mapped against your existing control catalogue, with the TokenWatch policy set drafted. This is the document your security team reviews and your procurement team attaches to the tender.
- 036 to 8 weeks
Pilot on real material
One team, real documents, running on your infrastructure. We build the evaluation set from your own cases so accuracy is measured against your standards, not a generic benchmark. Success criteria are agreed before we start.
- 044 to 6 weeks
Hardening and accreditation support
Penetration test, prompt injection testing, log and SIEM integration, TokenWatch policies moved from draft to enforced, and the evidence pack your accreditation process needs. We attend the review boards with you.
- 05per department
Rollout by department
Identity integration, training for staff and for the service desk, runbooks, and a support model that names who does what at three in the morning. Departments go live in sequence, each with its own classification profile.
- 06ongoing
Handover and ownership
Your team runs the system. We support it. You hold the knowledge base, the configuration, the evaluation sets and the agents. Quarterly we review model performance, refusal behaviour, policy changes and the egress record together.
Questions
Questions procurement and security teams ask
Short answers to the points that usually decide whether a public sector AI project can proceed.
Can a government agency run Uthereal without any data leaving its own infrastructure?
Yes. In the closed on-premise pattern, models, documents, embeddings, prompts and answers all run on agency hardware, there is no outbound path to a model provider, and updates arrive through a controlled offline transfer process.
What deployment patterns does Uthereal support for the public sector?
Three. Pattern A, closed on-premise for classified, criminal justice and health material. Pattern B, a sovereign cloud tenant in an in-country region with customer managed keys and zero data retention. Pattern C, a hybrid split where a classification gateway keeps sensitive work on-premise and routes general work to cloud services.
What is Uthereal Token Watch?
Uthereal Token Watch sits at the perimeter and meters every outbound token by user, department, destination and classification, inspects the payload for personal data and protective markings before transmission, enforces allow, redact or block policy in line, and writes a signed egress record for the security officer and auditor.
How does the system handle classification and access control?
Access comes from your directory over SAML or OIDC, and group membership drives retrieval. Classification labels travel with content from the source system through ingestion, retrieval and the answer, so a restricted document does not become unrestricted because it was summarised.
Does Uthereal meet Swiss and EU public sector requirements?
Deployments are built for data residency in named in-country data centres, legal jurisdiction you accept, customer managed keys in your KMS or HSM with no Uthereal decryption path, append-only audit shipped to your SIEM, and control mapping against your existing catalogue for revFADP, GDPR and EU AI Act reviews.
How long does a government deployment take to start?
A two-week scoping workshop selects use cases and classifies the material with your data protection officer, followed by three to four weeks of architecture and control mapping that produces the document your security team reviews and procurement attaches to the tender.
Start with one use case and a security officer in the room
Uthereal is a Swiss company and an ETH Zurich spin-off, based at Technopark Zurich. We build AI systems that public bodies and regulated organisations own outright, on infrastructure they control. If you are drafting a requirement, we are happy to review it before it goes out.