On-prem

On-prem Managed is the option for organizations with very strict security requirements, where data according to policy must stay within the own IT environment. Intric is installed and run on your own hardware, inside your own network, and the platform is by default only reachable from within it. You keep full control over both hardware and data flows — Intric operates the platform, you own the environment it runs in.

A complete platform, not a stripped-down edition

The on-prem installation is the same platform as the cloud service: assistants, knowledge bases with vector search, document and audio processing, integrations, and the administration interface. Nothing is held back for the hosted version.

Everything the platform needs to do its work runs on your server: the application and API, the identity provider, the databases, object storage, the message queue, and the processing workers that handle documents, PDFs and audio. Delivery is on Kubernetes, from versioned Helm charts, which is what makes upgrades predictable and repeatable rather than bespoke.

Data stays inside

No document, conversation or file leaves your environment as part of normal operation. The platform reaches outside only where you have explicitly opened for it in your firewall — typically to a language model provider — and those endpoints are listed and agreed before installation.

For environments that cannot allow outbound traffic at all, the platform can be installed fully air-gapped, with all container images mirrored into a private registry of your own.

Your models, or ours

Language models can be consumed from an external provider through a narrow, explicitly allowed set of endpoints, or hosted entirely inside your own data center on local GPUs — chat, embeddings and speech-to-text alike. With local GPUs, the need for external API calls is minimized or eliminated entirely, producing a closed environment for maximum security and integrity.

Both approaches can be combined, and the choice can change over time without reinstalling the platform.

Fits the network you already have

On-prem environments are rarely simple, and the platform is built for that: outbound traffic can be routed through your existing proxy, your organization’s own certificate authorities are trusted throughout, and the platform is served under your own hostnames and certificates. Sign-in uses the bundled identity provider or federates with the identity provider you already run, so users keep the accounts and single sign-on they have today.

Scales with the work, not with guesswork

Document and audio processing run as separate worker services that scale on queue depth — capacity follows demand instead of a fixed guess, and heavy ingestion jobs do not slow down everyday use of assistants. Sizing guidance for both a minimum and a recommended tier is documented, so hardware can be specified with confidence before anything is ordered.

Operated, not just delivered

Intric installs the platform, verifies it against the same checks used for every release, and keeps it maintained afterwards. Upgrades are applied as versioned releases and verified in place; the installation is documented so your own operations team can see exactly what runs and where.

---

Next: Server and Hardware for sizing, ports and network requirements, and Installation and Checklist for what to prepare before installation day.