An options assessment for putting a private AI assistant in front of confidential client material — what "legally covered" actually requires, the three ways to deploy it, what each costs, and a clear recommendation.
You can run a capable AI assistant over your clients' trade secrets and stay on the right side of the law — but "legally covered" is not a product you buy. It is a set of reasonable measures you take and can prove.
The strongest, simplest position for a small team is to run an open-weight model on hardware you own, on your own premises, with the data never leaving the building. It gives the best legal story and the most convincing answer when a client asks "who can see our data?" — the honest answer becomes "nobody but us, and here's why."
Renting a single-tenant server (no shared neighbours) under a data-processing contract is a solid second choice when you outgrow one machine or prefer a monthly bill to an upfront purchase. A managed private AI service (e.g. AWS Bedrock) is acceptable only when a client has explicitly signed off on it — it trades physical control for a contract.
A trade secret only stays a protected trade secret if its holder took reasonable steps to keep it secret. Lose the secrecy through careless handling and you can lose the legal protection itself — there is nothing left to enforce.
Your clients sit in different countries, but the standard barely moves between them. The global baseline (the TRIPS treaty, which the EU, UK, Canada and the US all sit under) and every regime built on it use almost identical wording:
Information subject to reasonable steps under the circumstances … to keep it secret.
Two consequences matter for your decision:
| Where the client is | What governs the secret | The test |
|---|---|---|
| Portugal (you) | Código da Propriedade Industrial (DL 110/2018), arts. 313–315 — transposes EU Directive 2016/943 | "reasonable steps" |
| EU clients | Trade Secrets Directive (EU) 2016/943, Art. 2 | "reasonable steps" |
| UK clients | Trade Secrets Regs 2018 + breach of confidence | "reasonable steps" |
| Canada clients | Common law / contract; CUSMA & TRIPS baseline | "reasonable measures" |
| Elsewhere | TRIPS Art. 39(2) — the worldwide floor | "reasonable steps" |
The shorter and more controllable that list, the stronger your legal position and the easier it is to reassure a client. Here is that list for each option.
You buy a GPU workstation, it lives in your office, the model runs on it, and the data never touches the internet.
A dedicated machine (e.g. Hetzner in the EU) that only you use — no shared neighbours — under a signed data-processing agreement.
A cloud AI endpoint (e.g. AWS Bedrock, Azure OpenAI) with enterprise terms: no training on your data, EU region, private networking.
| Criterion | A · Own hardware, on-prem | B · Rented single-tenant | C · Managed private service |
|---|---|---|---|
| Legal defensibility ("reasonable steps") |
Strongest No external disclosure |
Strong With DPA + hardening |
Workable Contract-dependent |
| Client-trust story | "Never leaves our building" | "One vetted EU host, under contract" | "Big-cloud terms & certifications" |
| Control of the data | Full physical control | You trust the host physically | Leaves your runtime |
| Ops burden on your team | You run the box | Host covers hardware | Lowest — fully managed |
| Upfront cost | ~€8k–12k one workstation |
~€80 setup | €0 |
| Monthly cost | ≈ power only + amortised hardware |
€184–€840 by GPU class |
Usage-based scales with use |
| Scales to many users | Add boxes | Add / resize servers | Elastic |
| Time to live | ~1–2 weeks (buy + set up) |
Days | Days |
Costs are indicative for a small-team assistant (see the cost section). "Single-tenant" is the line that separates a defensible rental from a risky one — a normal shared cloud VM, and especially an anonymous GPU marketplace, put unknown parties between you and the secret.
A workstation with a professional 48 GB GPU (the GPU alone is ≈ €6.8k) runs a strong assistant for a small team. Add electricity and a few hours of your time to set up and maintain.
Hetzner dedicated GPU servers in the EU: an entry box (20 GB GPU) at €184/mo, or a 48 GB-class box at ~€840/mo, each with a one-off ~€80 setup fee. Cancel when you want.
Billed by volume of text processed. For a small team this can be modest, but it climbs with usage and the data is handled by the provider's service.
One machine, an open-weight model, a private chat interface on your office network, no internet path for the data. This is the default and it covers a small team comfortably.
Move to OPEX or more horsepower without giving up single-tenancy. Sign the provider's data-processing agreement and apply the same hardening. Still defensible.
Use a no-training, EU-region enterprise service when ops simplicity or scale dominates and the client has signed off in writing on processor-based handling.
"Legally covered" and "clients feel safe" are two different jobs. The first is satisfied by the measures; the second is satisfied by showing them. The same setup that protects you in court is also your sales asset — package it.
Keep a short, client-facing assurance pack that maps your setup to the standard they care about:
Trade-secret law doesn't force a location the way data-protection law can — but clients feel it. You can offer:
| Client | Reassuring posture |
|---|---|
| EU | On-prem in Portugal, or EU-region host — squarely "at home". |
| UK | On-prem or EU/UK host; identical legal test applies. |
| Canada / other | On-prem is the universal answer; otherwise offer their preferred region. |
Owning the hardware sidesteps the whole "where is it hosted / who is the sub-processor" conversation — there is no host and no sub-processor. That simplicity is itself the reassurance.
No setup is risk-free. These are the ones that actually bite, with the simple mitigation for each — the engineering report details the controls.
The AI tooling quietly phones home, logs every prompt, or a "helper" feature sends text to a cloud API. Mitigation: block outbound traffic, turn off logging — verified in the technical build.
Strong tech, weak habits: shared passwords, no NDA, an ex-employee keeps access. Mitigation: individual logins + MFA, signed NDAs, an offboarding checklist.
The box or a backup drive walks out. Mitigation: full-disk encryption and physical security — a stolen encrypted disk is unreadable.
A shared VM, or worse an anonymous GPU marketplace, puts unknown parties next to the secret. Mitigation: single-tenant only, named provider, signed DPA — never a marketplace box.