Licensed to be used in conjunction with basebox, only.
// security
Model providers
Applies to
Product: Demo · Cloud · Server · Audience: Security / Compliance reviewer
Which model infrastructure is used per deployment model. In Cloud and Server the language model runs on the same server as the basebox platform; prompts go to no third party. Only the Demo uses an external model provider.
Per deployment model
| Where the language model runs | Who controls the hardware | Do prompts go to third parties? | |
|---|---|---|---|
| basebox Cloud | On basebox's own server, together with the platform; the server is located in the Noris data center in Munich | basebox | No – no data processing by any third party |
| basebox Server | On the server or a customer GPU host in the same network; bundled (vLLM in the chart) or the customer's external OpenAI-compatible endpoint | Customer | No – unless the customer connects an external service themselves |
| Demo | Claude via Google Vertex AI; the platform runs at Hetzner | Google (model), Hetzner (platform) | Yes – to Google, on the basis of a DPA |
The Demo is different
The Demo is a separate setup and not the Cloud. There, prompts go to Google Vertex AI. basebox is a processor in the Demo as well and has concluded DPAs with Google and Hetzner (basebox.ai/de/legal#data). Still, do not process real personal or patient data in the Demo – that is what Cloud and Server are for.
Which models
For Server, basebox provides open-source models – for example GPT-OSS 20B/120B, Llama 3.3 70B, Mistral variants – and documents source, licence and version in the Model register. The models are only quantized (runtime and memory optimization); no fine-tuning, no retraining, no change to weights or architecture (Compliance document). Before delivery basebox checks models for documented vulnerabilities and provides no models that violate Art. 5 EU AI Act.
In the Cloud the language model likewise runs locally on the basebox server.
In the Demo the model is Claude via Google Vertex AI – a proprietary third-party model.
Which models make sense on which hardware: LLM recommendations · Tested models.
External models on a server
Instead of the bundled inference, a server can use an external OpenAI-compatible endpoint (Connect inference). Documented and proven is this for a customer-owned GPU host in the same network. Technically an external AI service can be connected the same way – the compliance document mentions the "optional connection of external closed-source models (purchased separately by the customer)". Then:
- Prompts, history, retrieved context and document contents go to that service – outside your data processing boundary.
- The contract with the service (DPA, third-country transfer, training exclusion, retention) is your matter; basebox is not involved.
- The commitments of this documentation on data flows and storage do not apply to that path.
- No silent fallback: if the endpoint is offline, basebox shows the error; it does not switch unnoticed to another model.
Recommendation for regulated environments: local inference. Whoever connects an external service documents it as a processing activity of its own.
What the model sees
With every request: the organization's system prompt, the user's personalization, the conversation history, the current input, retrieved text passages from knowledge bases and documents, tool results from connectors and web search.
- Cloud: the request stays on the basebox server; there is no learning from requests.
- Server: vLLM keeps requests in GPU memory only for the duration of processing; there is no learning from requests (Inference architecture).
- Demo: the request goes to Google Vertex AI. Retention and processing there follow Google's terms and the DPA between basebox and Google.
What basebox does not do
- No training or fine-tuning on customer content – in no environment.
- No forwarding of prompts to third parties in Cloud and Server. Only in the Demo do prompts go to Google Vertex AI. Everywhere, the administrator-controlled exceptions web search and connectors come on top.
- No content filters as a security guarantee – behavioural rules are set by the system prompt, enforcement is done by approvals (Policies).
For the review
- Cloud: language model and platform on the same basebox server at Noris in Munich, no external model provider (Infrastructure).
- Server: include the inference host in the data processing boundary; with an external service, assess separately.
- Take the model list with version and licence from the Model register; document your own models yourself.
- Do not transfer Demo observations to Cloud or Server – the Demo is a different setup.
Next step: Web search