Installation
CoeOS deploys as a client + box (the router). The client holds no provider key or URL: it only talks to the box, the single egress gateway. The installation profile is fixed at deploy time and never changeable by a user.
The two profiles
Section titled “The two profiles”local — on-prem firm
Section titled “local — on-prem firm”Everything runs in the firm’s own infrastructure. Confidential data stays local: it never leaves for a cloud, even under a DPA. If the local endpoint is down, that is an error — never a silent fallback. This is the strictest posture for professional secrecy.
vps — dedicated cloud (e.g. OVH)
Section titled “vps — dedicated cloud (e.g. OVH)”One dedicated instance per client. Confidential data goes to cloud_dpa: a
provider under a data processing agreement, never a generic cloud. Suited to a
demo or a firm that accepts governed cloud processing.
What you need
Section titled “What you need”- The CoeOS box (the router) — holds the per-skill model registry, the key vault, and enforces the Guardian.
- A model provider — an API key (confidential traffic is routed by profile and class).
- A domain (for a VPS deployment) and a TLS certificate.
- Optional: OCR for scanned PDFs (Mistral OCR, cloud under DPA or self-hosted in a single container for the local profile); a document base (RAG) per project.
Network isolation
Section titled “Network isolation”At startup, the Guardian verifies the topology: the application, document search and document extraction have no route to the internet; only the box does. A check forbids any network call outside the single egress point.
Backup and retention
Section titled “Backup and retention”Encrypted daily backup. Automatic, logged purge: technical inference data at 30 days, authentication logs at 90 days. The detailed operations procedure lives in the infrastructure runbook shipped with the deployment.