Kernel is a self-hosted RAG platform that lets your team chat with your contracts, policies, research, and reports — without sending a single byte to OpenAI, Anthropic, or Google.
Deploy on your hardware. Govern it like the rest of your stack. Audit every answer.
The trade-off
Cloud AI tools want your documents. Building your own RAG stack takes months. Kernel gives you a third option: an enterprise-grade private platform you control, deployable in a single afternoon.
| Capability | ChatGPT Enterprise / Copilot / Glean | Building it in-house | Kernel |
|---|---|---|---|
| Data leaves your network | Yes — vendor cloud | No | No |
| Time to deploy | Weeks of legal review | Months of engineering | An afternoon |
| Audit log + RBAC + lifecycle | Vendor's policy | Build it | Built in |
| Pick which model runs each stage | Single vendor model | DIY | Yes — admin UI |
| “Why this answer?” trace | No | DIY | Yes |
| Where your data lives | Vendor's cloud | You decide | You decide |
Data leaves your network
Time to deploy
Audit log + RBAC + lifecycle
Pick which model runs each stage
“Why this answer?” trace
Where your data lives
Built for compliance
Kernel was built for the team lead who's tired of telling people "we can't use AI for that."
Your data stays in your VPC. Your audit team sees every retrieval. Your users get GPT-class chat over the documents they actually work with.
Run Kernel on your own server, your own EC2, or a single-tenant VPC we manage for you. No telemetry. No “we may use your prompts to improve our models” clause. The only egress to a third-party model is the one you explicitly configure — and only for the pipeline stages you choose.
Most RAG tools force one model to do everything. Kernel doesn't. Pick a fast local model for query routing, a mid-size local model for expansion, and route only the final answer through a frontier cloud model — or stay 100% local. Each pipeline stage (router, expansion, HyDE, relevance, RAPTOR, entity extraction, generation) gets its own primary and fallback, configurable from an admin UI.
Click “Why this answer?” on any response and see the route taken, the chunks retrieved, the model that wrote it, and whether the grounding check passed. If our Self-RAG verifier can't confirm the answer is supported by the sources, the UI flags it as low confidence. In regulated industries, “I can't explain where that came from” isn't an acceptable answer — Kernel never makes you say it.
What's inside
Not a demo.
Vector search, knowledge graph, and structured SQL fused by an intent router. Each question gets the retrieval path that actually suits it.
Hierarchical document clustering so broad questions get high-level synthesis and pointed questions get exact passages.
Retrieved chunks are scored for relevance; the final answer is verified against context and retried on failure.
File lifecycle (draft → pending review → approved), classification labels, RBAC across owner / admin / manager / user / auditor.
Tamper-evident audit chain. Scheduled encrypted backups covering the vector store, knowledge graph, and metadata.
Pull documents from Dropbox, Google Drive, or OneDrive. The originals stay on your storage; nothing routes through us.
How it works
A user asks one question. Behind the scenes, Kernel runs a pipeline of small, specialised steps — most of them on local models. Only the final answer ever needs a frontier model, and only if you choose.
Router
local
Expansion
local
HyDE
local
Retrieval
hybrid
Rerank
local
Generation
your choice
Grounding check
local
Router
local
Expansion
local
HyDE
local
Retrieval
hybrid
Rerank
local
Generation
your choice
Grounding check
local
Each box is independently configurable. Run the whole thing locally for zero data egress, or route specific stages through cloud models for higher answer quality. Cloud routing is available as an add-on.
Three ways to run it
Choose where it lives. Pricing is shaped to your scale, your model mix, and whether you want us to operate it for you.
Run Kernel on your own infrastructure. You manage upgrades, you keep the keys. Best for teams that already operate a Linux + Docker stack and want maximum control.
Let's talkSame deployment, with a support SLA, audit-log export, SSO/SAML, and assistance with upgrades. Best for compliance-driven mid-market firms.
Let's talkWe run Kernel for you on dedicated single-tenant infrastructure inside your preferred cloud region. You point a domain at it and your team starts using it. Best for regulated organisations who want the outcome without the operations.
Let's talkCloud-model routing (Claude, GPT, Gemini for any pipeline stage) is available as an add-on. Talk to us about your mix.
See it work
A 20-minute walkthrough on your own documents will tell you more than any datasheet. We'll set up a temporary private instance, ingest a sample of your corpus, and let you ask real questions live.
Request a demoEngineering writing
We write about how Kernel is built. Two posts to start with:
Trusted by teams that need to say "yes" to compliance
Tell us a bit about your team, your documents, and what compliance constraints you're working under. We'll show you exactly what Kernel would look like for you.
Let's talk