Sovereign AI by AOLC.

Sovereign AI by AOLC is a self-hosted artificial intelligence service for South African organisations whose data cannot cross national borders. AOLC runs open-weights models — Llama, Whisper, open vision LLMs — on infrastructure located in Johannesburg. No foreign AI APIs (Anthropic, OpenAI, Gemini, Azure OpenAI, AWS Bedrock) are on the data path. AOLC acts as Operator under section 20 of the Protection of Personal Information Act, 2013 (POPIA), while the client remains the Responsible Party.

All storage and inference takes place on South-African-domiciled infrastructure in Johannesburg. There is no cross-border transfer of data, so POPIA section 72 grounds for cross-border transfer are not required because no transfer occurs. Source material, derived metadata, transcripts, embeddings, and audit logs all remain inside the South African sovereignty boundary for the life of the engagement.

No. Sovereign AI by AOLC does not call Anthropic, OpenAI, Google Gemini, Microsoft Azure OpenAI, AWS Bedrock, or any other foreign AI API on the client data path. This is an architectural constraint, not a contractual one. AOLC operates open-weights models in its own tenancy on South African GPU compute. The list of foreign providers excluded from the data path is published openly above.

AOLC operates as Operator under section 20 of the Protection of Personal Information Act, 2013. The client (e.g. a university, law firm, government department) remains the Responsible Party and determines the purpose and means of processing. AOLC processes personal information only on the client's documented instructions, implements appropriate technical and organisational safeguards, notifies the client of breaches without undue delay, and assists with data-subject requests. Final POPIA compliance depends on the client's overall information-handling practices; Sovereign AI is designed to support, not replace, that compliance posture.

Sovereign AI uses open-weights models hosted in AOLC's own tenancy. The current stack includes the Llama family for general language tasks, Whisper for speech-to-text, and open vision LLMs for handwritten-text recognition and image analysis. Embeddings for semantic search are generated by open embedding models. The full list of in-use models, with version numbers and licences, is shared with each client under NDA as part of the vendor onboarding pack.

No. Client content is never used to train any commercial or foreign model. Open-weights models are invoked for inference only — model weights are not updated using client data. This is a hard architectural constraint enforced by the inference pipeline, not solely a contractual promise. If a future engagement involves fine-tuning, the resulting model belongs to the client and remains inside the client's sovereignty boundary.

Engagements are fully reversible on notice. On termination, AOLC returns all client data — source material, derived metadata, transcripts, logs, and any fine-tuned model artefacts — in open formats (JSON, CSV, original file containers). All copies are then cryptographically erased from AOLC systems within 30 days, with daily encrypted backups destroyed alongside the primary data. AOLC issues a certificate of destruction to the client.

The client retains sole ownership of all source material, derived metadata, transcripts, embeddings, and any models fine-tuned on client content. AOLC's role is that of Operator under POPIA section 20 — processing on the client's documented instructions, never as data owner. Ownership terms are codified in the engagement agreement before any data moves.

Microsoft Copilot and ChatGPT Enterprise route prompts and responses through Microsoft and OpenAI infrastructure, which sits primarily in the United States. Even where regional endpoints exist (e.g. Azure South Africa), the underlying provider is a US-headquartered company subject to the US CLOUD Act. Sovereign AI by AOLC runs on South-African-domiciled infrastructure operated by a South African company, with open-weights models and no foreign API on the data path. The difference is architectural — sovereignty is enforced by where the infrastructure sits and what the code does, not only by what the contract says.

Sovereign AI is built for sectors where data residency is a legal, regulatory, or professional obligation rather than a preference. Primary sectors include: archives and research (institutional memory, donor-restricted material), government (departments, municipalities, state entities), legal (matter file review, attorney-client privilege), medical (patient records as POPIA special personal information), and financial services (banks, insurers, FSPs subject to SARB, FSCA, FICA, and POPIA).