Data sovereignty isn’t one setting — it’s a spectrum. A fintech testing a new fraud model has a different risk appetite than a systemic bank handling classified counterparties. KeplerAI offers isolation tiers so you can match how much metadata (if any) leaves your environment to your actual constraints.
The three tiers
Standard. Metadata — schemas, column statistics, aggregated results — transits to the control plane. This gives the best code-generation quality, because the frontier model reasons over rich metadata. Raw data still never moves. This is the right default for most teams.
Restricted. Only tightly-scoped metadata and, where allowed, anonymized or synthetic samples transit — governed by a data-sharing matrix agreed with you. You trade some agent context for a smaller footprint.
100% local. Nothing leaves your data plane — not even metadata. A local model performs code generation inside your environment. Code quality is lower than a frontier model, but residency is absolute. This is the tier for environments where even schema names are sensitive.
The trade-off, honestly
More metadata sharing means better AI assistance; less means more residency. We won’t pretend the 100% local tier matches frontier-model code generation — it doesn’t. But for institutions that can’t let anything cross the boundary, degraded automation beats no automation, and it beats moving data.
Contractual and technical
Tiers are enforced technically, but they’re also a contract. Part of onboarding a regulated client is agreeing, in writing, exactly what may transit. The architecture makes that agreement enforceable rather than aspirational.
Start standard, tighten as needed
Most teams begin on Standard and move stricter for specific use cases or entities. The domain model stays identical across tiers — only the boundary policy changes. Read more in the security model.