Which mode should we start with?

If your data cannot leave your network, on premises. If most of it cannot but some work is worth sending out, hybrid. If none of that applies and you want a key today, Cloud. The modes are one spectrum rather than three products, and moving along it later is a licence change, not a migration.

What does on premises actually install?

The orchestrator, the router, and the console, as containers you run in your own environment: your servers, your cloud account, or an air gapped rack. There is no call home required for it to serve traffic, and no component of it we operate.

Can we run it with no outbound network at all?

Yes. The heartbeat that reports version and licence state carries metadata only, and it can be switched off; releases and model weights are then delivered as artefacts you bring in yourself. Nothing about a request is in that channel whether it is on or off.

Do we have to change our code?

Only the base URL. All three modes are drop in compatible with the OpenAI API, so the official SDKs work unchanged. The extra ModelBeat returns (which model ran, on which provider, whether a fallback fired, what it cost) rides in the response alongside the fields you already read.

Can we move between modes later?

Yes. The engine is the same binary in all three; what differs is where it runs and what policy permits. Moving from one to another is a licensing conversation, not a rebuild.

Your models, your hardware, your audit trail.

The orchestrator runs inside your perimeter, on your own models. Hybrid adds an exit governed by policy, not trust.

Looking for Cloud pricing

Annual licence · quoted against your estate · SLA included

Enterprise · licensed SDK

On premises

Seats or usage. Quoted per estate.

The full orchestrator runs on your own infrastructure, against your own models. No request ever reaches a machine you do not own.

Orchestrator, router, and console installed in your environment
Runs only against self hosted models and private endpoints
Air gapped operation supported; the heartbeat is optional metadata
Your own price table, audit log, and keys all on your storage

Built for

AI companies selling into regulated buyers.

Enterprise · licensed SDK

Bring your own cloud

Same licence as on premises, in your own cloud account.

The same orchestrator and the same perimeter, in your cloud account instead of your hardware. Nothing to rack, so it is live faster.

Orchestrator installed in your own cloud account
Runs only against self hosted models and private endpoints
No hardware to rack, so it goes live faster than on premises
Your own price table, audit log, and keys all on your storage

Built for

Teams that want the on premises perimeter without racking hardware.

Enterprise · licensed SDK · metered burst

Hybrid

Licence for the engine. Credits for what leaves it.

Your own orchestrator and models, with policy deciding which requests may route out to provider APIs at metered rates.

Everything in On premises
Governed egress to provider APIs by policy, not by exception
Rules on work type, data label, destination, and spend ceiling
One ledger and console across both sides, egress billed at Cloud's rates

Built for

Teams with a residency line and frontier work on either side.

What you are buying

4 things a licence turns on.

Where the binary runs, what is allowed to cross the boundary, who holds the evidence afterwards, and what procurement has to sign. In our experience nothing else decides it.

What installs

The orchestrator, the router, and the console, as containers you run in your own environment. There is no component of it we operate and no call home required for it to serve traffic.

Your servers, your cloud account, or an air gapped rack
Runs against self hosted models and private endpoints
Releases delivered as artefacts you bring in yourself where there is no egress
Named engineer for the install and for each version upgrade

What crosses the boundary

On premises, nothing. Hybrid adds a governed way out, and the rules are yours: policy is evaluated before inference rather than appealed to after it.

Rules read on class of work, data label, destination, and spend ceiling
A request no rule admits is answered inside your estate, or refused
The heartbeat carries version and licence state only, and can be switched off
Egress is metered against the same credits and the same rates as Cloud

What you keep

The evidence lives on your storage, not ours. That is the difference between being able to answer an auditor and having to ask a supplier to answer them for you.

Immutable audit log of every privileged change, append only
Per request accounting priced against a table you supply
Virtual keys with request and token caps, revoked on the next request
Provider keys stay where they are issued. In a licensed mode we never see them

How it is bought

An annual licence quoted against your estate. The variables are how many models, how many environments, and how much of the operation you want to keep, which is a short and specific conversation rather than a form.

Licence for the engine; hybrid adds credits for what leaves your walls
Seats or routed volume, whichever fits how you are organised
SLA and named engineer included at every licence size
Security review, DPA, and architecture walkthrough before signature

Side by side

The same engine, 3 ways to host it.

Your servers, your cloud account, or hybrid with a governed exit, side by side: what installs, what is allowed to cross the boundary, and what actually changes between them. Cloud pricing is its own page, linked above.

Deployment modes compared across perimeter, estate and routing, governance, and commercials.
Capability	On premisesEnterprise · licensed SDK	Own infrastructureBring your own cloud	HybridEnterprise · licensed SDK · metered burst
Perimeter
Orchestrator runs	Your infrastructure	Your cloud account	Your infrastructure
Inference runs	Your models only	Your models only	Yours, plus provider APIs by policy
Prompts and completions leave your network			Only where policy allows
Runs fully offline
Telemetry to ModelBeat	Metadata only, and optional	Metadata only, and optional	Metadata only, and optional
Estate and routing
Approved estate	Yours, admitted by Elytra	Yours, admitted by Elytra	Yours, plus the public estate
Bring your own endpoints
Predictive routing on quality, cost, and residency
Failover across providers	Across your own replicas	Across your own replicas
Residency rules enforced before inference			By region
Governance
Per request cost accounting
Price table	Yours	Yours	Yours, plus ours for egress
Immutable audit log	On your storage	On your storage	On your storage
Virtual keys, budgets, and caps
Policy engine for egress	No egress to govern	No egress to govern
Commercials
How you are billed	Annual licence	Annual licence	Licence, plus credits for egress
Minimum commitment	Annual	Annual	Annual
Time to first routed call	Days, install led	Hours, cloud install	Days, install led
Support	Named engineer, SLA	Named engineer, SLA	Named engineer, SLA

Also from Neural Arc

Your team is already paying for AI.

Helium One

For teams · min. 5 seats

One governed workspace for the whole team. Your documents are uploaded once, every query the team makes is grounded in them, and every privileged action is logged.

The Helium One workspace: a single prompt bar over the team's shared context, badged with the workspace it belongs to, with Build, Design, Analyze, Draft, and Research modes beneath it.

01Shared knowledge baseSOPs, policies, and proprietary data, uploaded once

02Shared prompt libraryWhat works for one teammate becomes reusable for all

03Governed by defaultAccess controls, usage visibility, and a full audit log

Visit Helium

Questions

What a deployment conversation asks.

Questions about credits, rates, and what a call costs are answered on the pricing page.

Deployment

Tell us what is not allowed to leave.

A licence is quoted against your estate, so the conversation is short and specific: which models, how many environments, and where the line runs. We will bring the architecture walkthrough and the DPA to it.