tenantplaneBook a demo Private inference means the agreed computation and data paths stay within the boundary your team has approved. Downloading open weights does not establish that boundary. Sequence preprocessing, external databases, model downloads, observability, and support tools can still send information elsewhere.
For a biotech R&D team, start with the selected model and a specific research workflow. “Run AI on premises” is too broad to specify an implementation or price.
Start with the research workload
Write down the input, output, representative batch, and turnaround requirement. Protein embeddings, structure prediction, docking, and a document assistant have different dependencies and evaluation needs. A working embedding endpoint does not demonstrate that a folding workflow is supported.
Benchling’s May 2026 Model Hub announcement describes scientific workflows including batch predictions, MSA reuse, and traceability between inputs and outputs. Those requirements go beyond an HTTP model endpoint. Use your actual scientific workflow to decide whether you need a model service, workflow integration, or an existing scientific platform. Benchling Model Hub announcement.
Map preprocessing before promising privacy
Inspect the selected model’s own installation and inference instructions. Does preprocessing call an external service? Does the workflow download a database? Where are intermediate files, sequences, structures, and error reports stored?
For example, the Boltz repository documents an optional –use_msa_server inference flag. That is a concrete dependency to review, not evidence that every Boltz installation sends sequences externally. A private deployment must make an explicit choice about the MSA path and its data handling. Do not assume that a model’s weights being local makes preprocessing local. Boltz repository and inference instructions.
Separate setup access from runtime access
Package installation and model acquisition may need internet access even when inference does not. List the two phases separately.
| Phase | Questions to resolve |
|---|---|
| Model acquisition | Which publisher, revision, files, license, and hashes are approved? Who reviews changes? |
| Package setup | Which registries, system libraries, drivers, and build tools are required? Can approved artifacts be staged? |
| Preprocessing | Are there external sequence services or scientific databases? Where do intermediate files go? |
| Inference | Where do requests, embeddings, logs, and temporary outputs exist? Which callers are authorized? |
| Operation | What do monitoring, incident response, updates, and support access expose? Who owns them? |
Record the approved model revision, required files, and license before installation. Separate the setup download from runtime access, verify local artifacts, and review any requirement to execute model-provided code before release.
Make each security claim testable
“Private,” “secure,” and “audit-ready” are not interchangeable acceptance criteria. Specify the claim, the control, the evidence, and what the test cannot establish.
Our reference verifies artifact identity, rejects unauthenticated requests, enforces input bounds, and runs actual inference. A separate test blocks selected Python socket entry points during a fresh-process inference run. This provides evidence about those instrumented calls only. It does not observe all packets, intercept native-library networking, or establish an air gap.
A production boundary claim needs controls and observations in the actual target environment: approved network rules, ingress and egress paths, identity, secrets, logging, and the relevant workload. Hash verification does not identify every malicious model. Safe serialization does not remove dependency vulnerabilities. The reference is not a compliance certificate.
Compare an installation with a managed platform
Customer-controlled deployment is not an unserved category. Benchling’s May 2026 inference announcement describes deployment choices through Baseten, including a customer’s VPC and hybrid arrangements. A team already using that workflow may get more value from the integrated platform than from commissioning a separate endpoint. Benchling Inference announcement.
A standalone implementation becomes worth evaluating when the model is already selected, existing compute and an operator are available, and a specific boundary or integration requirement remains unmet. Confirm that gap with the platform before assuming custom work is necessary.
Price the implementation and operation separately
A one-time deployment fee is not a first-year operating cost. Include compute, storage, network usage, model or service licenses, operator time, updates, and required availability. Large scientific databases and preprocessing can materially change the scope.
The proposed $7,500 deployment-only starter covers an approved model, an existing qualified environment, and one synchronous interface with an HTTP example. Scientific workflow integration is not included. The separate private workflow implementation includes one agreed application path; it does not automatically include scientific evaluation or a durable job system. The cost worksheet supplies editable planning scenarios, not model-capacity recommendations or private-cloud quotes.
The useful first deliverable is a precise agreement about what will run, where it will run, what acceptance means, and who operates it afterward. That is how a narrow model-serving project stays narrow.