A private endpoint, a retention policy, and a disconnected installation answer different questions. They can coexist, but one does not prove the others. Before comparing vendors, write down the data boundary and the property you need.
This distinction is useful in a buying discussion because “our data stays private” is too broad to verify.
Retention is about what remains
A zero-retention arrangement concerns what a provider stores after processing, subject to the precise service terms and configuration. It does not mean that the provider never received the input or processed it.
For an actual procurement decision, inspect the applicable terms for each endpoint and feature. Consider request logging, file uploads, asynchronous jobs, safety monitoring, backups, and support access. Avoid generalizing one service’s policy to every feature from the same vendor.
If your requirement forbids external processing, a promise about storage after processing cannot satisfy it on its own.
Private transport is about the network path
A private connection can keep traffic off public internet paths. It does not establish that the model runs in your own tenant, that the provider cannot process the data, or that nothing is logged.
For example, AWS Bedrock PrivateLink documentation describes connecting a VPC to the managed Bedrock service without requiring an internet gateway or public IP addresses. This is an important network control; the service boundary still matters.
Ask where the private connection ends and which account or service operates inference beyond it.
Zero egress needs a named boundary
A strict external zero-egress runtime denies new outbound connections beyond its defined perimeter. Authorized clients still send requests and receive responses through permitted access paths. Internal services may communicate within that perimeter.
Define whether the boundary encloses the model process, its container, an application network, or the whole installation. A sandbox with no direct networking can still send information to a broker that calls an external service. The sandbox boundary and the full application boundary are different.
If a license check, telemetry collector, or external identity service is permitted, document that path. “No customer-content egress” and “no external network egress” are distinct claims.
Air-gapped and sovereign are broader choices
A disconnected or air-gapped environment operates without an external network connection. Its software supply, maintenance, and identity systems need to support that lifecycle.
Sovereignty can additionally concern jurisdiction, administrative control, infrastructure dependency, and the ability to operate independently. A deployment in a particular country does not, by itself, settle all those questions.
Use specific requirements in a design document instead of treating these terms as interchangeable assurance labels.
Compare the questions directly
| Question | Relevant evidence |
|---|---|
| Who processes my prompts? | Service boundaries and processing terms |
| What is stored afterward? | Retention settings, policies, and logs |
| Does traffic use public internet paths? | Routing and private-endpoint configuration |
| Can the runtime initiate external connections? | Enforced policy and negative connectivity tests |
| Can the installation run disconnected? | Dependency inventory and offline lifecycle tests |
| Who controls administration and jurisdiction? | Operating model, access, and contractual review |
A single diagram can show where inputs, outputs, and operating data travel. Pair that diagram with evidence for the specific properties you require.
Turn the distinction into a decision
Consider an internal document assistant. If an approved provider may process the documents but public internet exposure is prohibited, private connectivity may fit. If no third-party model service may receive them, customer-controlled inference becomes a candidate. If the installation must work without external connectivity, the supporting services must be designed accordingly.
The next step is to inventory the application and its dependencies. The zero-egress reference architecture gives that inventory a practical structure.