Field note · Customer education
AI SaaS, API or private cloud: a buyer’s decision guide
Compare a ready-made AI service, a model API, private cloud and an on-premise deployment using your workflow, data boundary and operating team.
- Source
- Editorial guidance with 1 retrieved source documents for context. Recommendations are our judgement.
- Evidence
- none on this page — it links to the pages that hold it
By Is There an AI for This? · Editorial guidance · Reviewed · How we use evidence
01Choose the operating responsibility you can support
Begin with the work, the information it uses and the people who will operate the result. “We need private AI” is incomplete until you define what must stay private, who may access it and which external organisations may process it. Ask the business owner to draw the document’s journey from arrival to final approved output.
For this guide, SaaS means a finished application operated by a supplier. An API is a connection your software uses to request a model’s output. Private cloud means a deployment in a cloud environment your organisation controls. On-premise means a deployment on machines at your site. These are working definitions for comparing proposals; obtain the actual architecture for each offer.
02Compare what you buy and what remains your job
| Route | What you buy | What you must establish |
|---|---|---|
| Ready-made SaaS | An application with a supplier-operated interface and workflow. | Plan-specific access, permitted data, integration fit, export and the person who administers it. |
| Model API | Model responses that your application turns into useful work. | An application owner, review screen, integrations, usage limits, testing and failure recovery. |
| Private cloud | A controlled cloud environment for a configured application and supporting services. | Who patches it, watches failures, manages identities, pays for capacity and restores the data. |
| On-premise | A deployment on your own site, with the intended data flows explicitly documented. | Hardware capacity, backups, access, updates, support and a test of every outbound connection. |
Do not read the route name as a security result. Request a diagram that includes document conversion, model processing, search indexes, logs, backups and support access. A private interface can still call an external model. A local model can still receive documents through a cloud service. Review the complete path.
03Use the same brief for every supplier
If a supplier proposes an API, ask who is building the rest of the application. The proposal should show where staff review answers, how access is enforced and how approved work reaches the existing system. A low model-usage estimate is not a quote for that whole workflow.
04Ask questions that eliminate unsuitable offers
- Which exact files, prompts and outputs leave our environment, to which named services, and for what purpose? Mark unknown destinations as unresolved.
- Can the workflow preserve our existing department and project access? Demonstrate with a real denied-access test, including after a user changes roles.
- Who answers when the service fails during our operating hours? Ask for responsibility, response arrangements and a recovery demonstration.
- Can we export original files, approved outputs, configuration and useful logs? Ask what needs rebuilding when the supplier or model changes.
- What is the full cost at our ordinary and peak workload? Use the same volume, document length, user count and review requirement in every proposal.
05Choose the smallest route that passes your requirements
- RECOMMENDATION
For a company with one general IT manager, we recommend comparing a governed SaaS pilot first when its data boundary is acceptable, and funding an operator before selecting a custom deployment.
BasisThis depends on permitted external processing, workflow fit and limited internal operating time. The vendor privacy source is a starting document for plan-specific review, not an endorsement or a guarantee for a proposed contract.
An illustrative acceptance gate is successful completion of the same 40 representative tasks, all required access tests passing, full cost within the agreed ceiling and a recovery drill run by the named operator. Record quality and review time by route rather than choosing from feature counts.
Stop evaluating a route if the required data boundary cannot be demonstrated, the operating responsibility has no owner, or a needed integration exists only as an unpriced promise. Resolve that gap before discussing a longer contract. A supplier can be competent while its offer is unsuitable for your particular operating constraints.
06Related
Use cases
Stacks
Deployment reports
More field notes
07Evidence
- 01Tier 2official vendor legal documentationVendor legal and technical documentation
Enterprise privacy at OpenAI | OpenAI
https://openai.com/enterprise-privacy
FreshRetrieved 19 Sep 2026sha256:925098213d771 record
08Primary-source reading
Consult these primary documents when checking a proposed product. Reading links remain available when evidence has not been verified; they do not establish that your planned use is approved or that a recommendation has been proven.