AI in the cloud or on your own servers where the data lives and what it costs
The four ways to use AI on company documents, what each one guarantees on training, data location and GDPR, what it costs at the providers' price lists and who keeps it running, with an example on 2,000 questions a month.
What are the ways to use AI on company documents?
Four, and they differ in two things: who runs the model and where it runs. People usually count three, US cloud, European cloud and your own servers; but “European cloud” lumps together two different things, a European provider and the European region of a US provider, and so the middle way is left out, an open model on a rented GPU.
| Option | What it is | Where the documents go | Who runs the model |
|---|---|---|---|
| seat-based chat | ChatGPT Business, Claude Team or Enterprise, with company accounts | the provider's servers | the provider |
| API in your own software | an application of yours that sends the model only the passages it needs, with the permissions of whoever asks | the model provider's servers, in Europe if the provider offers it | the provider |
| open model on a rented GPU | an open-weight model, such as Llama, Qwen or Mistral, on a machine with a GPU reserved for you at a provider | the data centre of the provider you choose | you, or whoever runs it for you |
| model on your own servers | the same model, on a machine with a GPU on your premises or in your own rack in a data centre | they stay inside your perimeter | you, or whoever runs it for you |
In the last three options the document assistant is a piece of software: it finds the passages that answer the question, hands them to the model and answers citing the document they come from. That is RAG. The application that reads the documents, checks permissions and keeps the logs is built the same way in all three; only where the language model runs changes.
Is the data I send to ChatGPT or Claude used to train the models?
With a business plan or with the API, no, by default and by contract; with an employee's personal account it is not the company's call. According to the providers' texts read on 30 October 2026:
| Service | Training | Retention |
|---|---|---|
| OpenAI API | data sent is not used to train the models | abuse monitoring logs are kept up to 30 days; zero retention for eligible customers |
| Anthropic API | no training without explicit permission | by default the content is not retained, except for the Fable and Mythos models, which keep it 30 days; zero retention on request; content flagged for violations up to 2 years |
| ChatGPT Business | no use of business data for training, by default | under the contract |
| Claude Team and Enterprise | no training on your content, by default | under the contract; the API's zero retention does not apply to these plans |
Google and the AI assistants get this wrong too. On 30 October 2026 Google's AI Overview wrote that standard plans use the data for training, mixing up the API with the chat, and Perplexity that Anthropic keeps data 30 days as the rule: for the API the opposite holds, except for Fable and Mythos.
A provider that does not train on your data still receives it, though: with a cloud service the documents reach its servers, which process them and, in the cases in the table, keep them for a period. The documents stay in house only with a model of your own.
The most concrete risk is the personal account. An employee who pastes a contract into the free chat is using terms they accepted, not the company, and the company does not know where the document ended up. The rule costs little: company accounts for everyone, and a written ban on using personal ones for work documents.
Where is the data processed, and can it stay in Europe?
Yes, with almost every provider, usually for 10% more; but the European region of a US provider says where the data is, not which law can ask for it.
| Provider | European option | Cost | What remains |
|---|---|---|---|
| Anthropic, direct API | none: processing is global, and the regional option covers only the United States | for the United States, 1.1 times the price | for Europe you go through Amazon Bedrock or Google Cloud |
| Claude on Amazon Bedrock or Google Cloud | regional endpoints | 10% more | the contract is with Amazon or Google |
| OpenAI API | data residency, requested from sales and enabled per project | 10% more for models released from 5 March 2026 | it needs approval of the abuse monitoring controls and a contract amendment on retention; some system data may be stored outside the region |
| OpenAI on Azure | the Data Zone deployment, which processes data only within Microsoft's European zone | Azure price list; the global deployment costs less | the contract is with Microsoft |
| Mistral API | the European endpoint, which processes in the EU and EFTA | 10% more | no Agents, Batch or Files; account management is not regional |
| OVHcloud, AI Endpoints and GPU instances | European provider | price list in euros, excluding VAT | where each AI Endpoints model runs is a question for the provider |
A US provider remains subject to the CLOUD Act, the 2018 law that requires it to preserve and disclose to US authorities the data in its possession, whether stored in the United States or outside (18 U.S.C. § 2713). That is why “European cloud” has two meanings, which the AI assistants mix up too: on 30 October 2026 Perplexity called Azure and Vertex AI a European cloud, and they are Microsoft and Google services in a European region. If the requirement is that no authority outside the Union can ask for the documents, you choose the provider, not just the region.
For personal data sent to a US provider the Data Privacy Framework applies today, the adequacy decision of 10 July 2023, and only if the provider is certified. The EU General Court dismissed the action against the DPF on 3 September 2025, and the appeal is pending before the Court of Justice (case C-703/25 P). The Privacy Shield, which Google's AI Mode still cites, was struck down on 16 July 2020.
Does a model on your own servers settle GDPR?
No. GDPR applies inside the company too: it removes the model provider and the transfer, if nobody accesses it from outside, but the other obligations remain, and security becomes entirely yours. On 30 October 2026 Google's AI Overview called the GDPR risk “nil” and AI Mode “zero”: both are wrong.
| GDPR obligation | With a cloud provider | With the model on your own servers |
|---|---|---|
| legal basis, purpose, data minimisation (Articles 5 and 6) | apply | the same |
| contract with the processor (Article 28) | with the model provider, which lists its sub-processors | with whoever runs the server for you, unless you do it in house |
| transfers outside the European Economic Area (Articles 44-49) | if the provider or its sub-processors are outside: DPF or standard contractual clauses | none, unless support or backups come from outside |
| security of processing (Article 32) | the provider guarantees its part, yours remains | all yours: access, updates, encryption, backups, logs |
| impact assessment (Article 35) | if the processing is likely to result in a high risk | the same |
Two things hold in every option. The index the assistant builds on the documents, the embeddings, holds the same information in another form: treat it like the documents, same place and same permissions. And an assistant that answers everyone on everything shows a contract to someone who could not open it: folder permissions must also hold in the answer (RBAC). The model provider does not answer for this: whoever builds the application does.
What does each option cost?
The pay-per-use model costs little; the seats, the dedicated GPU and the people cost. Take a 60-person company with about 5,000 internal documents and 2,000 questions a month. Our assumptions: each question sends the model about 10,000 tokens, between instructions, retrieved passages and the question, and receives 1,000. That makes 20 million input tokens and 2 million output tokens a month.
| Model | Provider | Price per million tokens, input and output | Per month, in the case |
|---|---|---|---|
| Mistral Small 3.2 24B | OVHcloud AI Endpoints | 0.09 and 0.28 € | 2.36 € |
| gpt-oss-120b | OVHcloud AI Endpoints | 0.08 and 0.40 € | 2.40 € |
| gpt-6-luna | OpenAI | $0.10 and $0.50 | $3 |
| Claude Haiku 5.5 | Anthropic | $0.10 and $0.50 | $3 |
| Mistral Small 4, European endpoint | Mistral | $0.165 and $0.66 | $4.62 |
| Llama 3.3 70B | OVHcloud AI Endpoints | 0.67 and 0.67 € | 14.74 € |
| gpt-6.1-terra | OpenAI | $1 and $5 | $30 |
| Claude Sonnet 5.5 | Anthropic | $2 and $10 | $60 |
| Claude Opus 5.5 | Anthropic | $4 and $20 | $120 |
Indexing the documents is paid once: 5,000 documents of about 5,000 tokens are 25 million tokens, about 2.50 € with Qwen3-Embedding-8B on AI Endpoints. For the same case the AI assistants give from 5-15 € to 20-100 € a month without doing the sum; ChatGPT, which does it, takes GPT-6.1 Terra at $0.50 and $2.50, half the price list, which says $1 and $5.
The other items, for the four options:
| Option | Item | Cost |
|---|---|---|
| seat-based chat | ChatGPT Business, 60 people | 60 × 21 € = 1,260 € a month, Italian price list |
| seat-based chat | Claude Team, 60 people | 60 × $20 = $1,200 a month, billed annually |
| API in your own software | model usage | $3 to $120 a month in the case, plus the application |
| rented GPU | OVHcloud instance with one 48 GB L40S | 1.40 € an hour, 1,008 € a month always on, excluding VAT |
| your own servers | machine with GPU | ask a reseller; the AI assistants' estimates range from 4,500 to 70,000 €, without a source |
| your own servers | electricity for the card alone, always at full power | L40S, 350 W: about 65 € a month; RTX 5090, 575 W: about 107 € a month |
| rented GPU or your own servers | people who keep it running | in the AI assistants' estimates, from 300 € a month to half a full-time person, without a source |
Seats and the API do not buy the same thing: a seat plan gives everyone a chat for every job, the API serves only the assistant you build. But for the document assistant, 60 Claude Team seats cost a month what twenty months of Sonnet 5.5 via API cost in the case. Watch the GPU price: 1.55 € an hour, the figure ChatGPT gives, is for the same card in the AI Deploy service; the instance costs 1.40 €. The electricity is a ceiling: the card alone at full power for 720 hours, at the average price for Italian businesses in the first half of 2026, 0.2575 € per kWh excluding VAT and recoverable taxes (Eurostat). The rest of the machine draws more, an idle card draws less.
The figures in this guide
Prices of models, plans and GPUs are those published by the providers and read on 30 October 2026, and they change often. The cost of the case, the break-even and the electricity are estimates with declared assumptions, to be redone with your volumes. Volcanic Minds prices and durations are current at the date at the top of the page.
When does a model on your own servers pay off?
In three cases: when a contract or the sector forbids the documents from leaving, when volumes are very high and steady, or when a small model is enough for a narrow task. For everything else the pay-per-use model costs less.
The sum has to be done on the same model, Llama 3.3 70B, paid per token on AI Endpoints or on a dedicated L40S GPU from the same provider. The GPU costs 1,008 € a month; at 0.67 € per million tokens, the same amount pays for about 1.5 billion tokens a month. At the 11,000 tokens per question of the example that is about 137,000 questions a month, 68 times the 2,000 of the case. A single card would have to produce about 53 tokens per second on average, day and night, with the model cut to 4 bits to fit: a number to measure on the machine. Google's AI Mode puts the break-even above 1 to 5 million tokens processed a month, but at the 30 October 2026 price lists 5 million Llama 3.3 70B tokens cost 3.35 €.
How big the card must be depends on the model file, plus room for the conversations in progress:
| Model | File | Where it fits |
|---|---|---|
| Qwen3 32B at 4 bits (Q4_K_M) | 19.8 GB | in a 32 GB RTX 5090, with room for the context |
| Qwen3 32B at 8 bits (Q8_0) | 34.8 GB | not in a 32 GB card |
| Llama 3.3 70B at 4 bits (Q4_K_M) | 42.5 GB | in a 48 GB L40S with little margin, or across two cards |
On the size of the model the AI assistants do not agree: for the same case Google's AI Overview wants a 70-billion-parameter model, AI Mode an 8-billion one, ChatGPT one from 14 to 32. Which one is enough is shown by a test on your own questions.
The right option is often mixed, by class of document: the API for what can go to a provider under a contract, processing in Europe for what must stay there, your own servers for what cannot leave. And within a process, as our FAQ on models puts it, “each step of the process goes to the smallest model that does it well”: classifying an email or extracting a code is done by a small model, which also runs on your own servers. Either way it pays to write the application so that the model can be swapped, because models and price lists change.
Who keeps each option running?
The closer the model gets to your premises, the more work passes to you. Accounts, usage rules and training always stay with you; for the rest, where the table says “you” it also means whoever does it for you.
| Option | Model and the service that runs it | Machine, network, electricity and failures | Application and backups |
|---|---|---|---|
| Seat-based chat | provider | provider | there is no application; the provider makes the backups |
| API in your own software | provider; the choice of model is yours | provider | whoever develops the application; backups by whoever runs it |
| Rented GPU | you | provider | whoever develops the application; backups by you |
| Your own servers | you | you | whoever develops the application; backups by you |
The model covers installation, updates and tests when a new one comes out, the service also capacity and monitoring; the machine covers physical security, cooling and spare parts. The application is document search with its permissions and logs, and the backups cover the documents and the index.
The estimates you find of the people's work, from 300 € a month to half a full-time person, have no source. Ask for the real number from whoever runs your servers today, before comparing a GPU with a per-token price list.
Where do you start?
With the class of document, before the provider.
- List the documents the assistant has to read and split them into three classes: those that can go to a provider under a contract, those that must stay in Europe, those that cannot leave by contract or by law.
- Give everyone a company account and write the rule against personal accounts: it removes the most common risk and waits for no project.
- Choose the option for each class, and have the provider put region, retention and sub-processors in writing.
- Test the assistant on a narrow scope and measure the cost per question, the quality of the answers and how permissions hold.
Cloud or your own servers makes no difference to us: we work on both, and we tell you which one suits your case. As our FAQ on where the data lives puts it, “the choice is made at the start on regulatory, contractual and budget constraints, not on our convenience”. In the cloud we choose Enterprise-grade services that contractually exclude training on your data, and Zero Data Retention services when more is needed; if the data is particularly sensitive or the sector requires it, we consider a private AI infrastructure, European, national or on-premise, as the FAQ on training says.
If the option is a project, the phases and prices are those of the guide AI in business: where to start. The feasibility study, 1-2 weeks and up to 2,500 €, says which option suits each class of document, what model usage costs and the criterion for stopping. The study stays yours even if you do not sign, and if you sign its cost is deducted from the pilot. The pilot, 4-6 weeks from 10,000 €, puts the assistant to work on a narrow scope and measures the result. Model usage, or the GPU if that is the option, is a recurring cost of yours, declared in the quote; maintenance, if you want it, is a separate contract.
Would you rather talk it through?
Book a call with people who work on these topics every day: we will look at your case together.
When do you need neither a server nor a project?
When AI is for writing, summarising and translating documents that can leave, and when the only worry is training. In the first case a seat-based plan is enough, with company accounts and a usage rule. In the second the business plan or the API already exclude it, by default and by contract, with no server at all. A GPU of your own for 40 people asking a few questions a day is a fixed cost that works a few hours.
And if the documents are in a mess none of the four options answers well: the assistant cites the old procedure with the same confidence as the new one. Data in order comes first.
If a seat-based plan with a usage rule is enough for you, we will tell you.
Sources and further reading
- Anthropic, “Pricing”, prices of the Claude models and of regional processingplatform.claude.com, accessed 30 October 2026
- Anthropic, “API and data retention”platform.claude.com, accessed 30 October 2026
- Anthropic, “Pricing”, Team and Enterprise plansclaude.com, accessed 30 October 2026
- OpenAI, “Pricing”, API pricesdevelopers.openai.com, accessed 30 October 2026
- OpenAI, “Data controls in the OpenAI platform”developers.openai.com, accessed 30 October 2026
- OpenAI, ChatGPT Business, prices for Italyopenai.com, in Italian, accessed 30 October 2026
- Mistral, “API pricing”docs.mistral.ai, accessed 30 October 2026
- Mistral, “Regional inference”docs.mistral.ai, accessed 30 October 2026
- OVHcloud, “Price list”, GPU instances and AI Deployovhcloud.com, accessed 30 October 2026
- OVHcloud, “AI Endpoints”, model catalogueovhcloud.com, accessed 30 October 2026
- Microsoft, “Understanding deployment types in Microsoft Foundry Models”learn.microsoft.com, accessed 30 October 2026
- 18 U.S.C. § 2713, CLOUD Actlaw.cornell.edu, accessed 30 October 2026
- Commission Implementing Decision (EU) 2023/1795, EU-US Data Privacy Frameworkeur-lex.europa.eu, accessed 30 October 2026
- Court of Justice of the European Union, case C-703/25 P, Latombe v Commissioncuria.europa.eu, accessed 30 October 2026
- Regulation (EU) 2016/679, GDPReur-lex.europa.eu, accessed 30 October 2026
- Hugging Face, “Qwen3-32B-GGUF”huggingface.co, accessed 30 October 2026
- Hugging Face, “Llama-3.3-70B-Instruct-GGUF”huggingface.co, accessed 30 October 2026
- NVIDIA, GeForce RTX 5090, specificationsnvidia.com, accessed 30 October 2026
- NVIDIA, L40S, specificationsnvidia.com, accessed 30 October 2026
- Eurostat, electricity prices for non-household consumers (nrg_pc_205)ec.europa.eu, accessed 30 October 2026
Do ChatGPT and Claude use company data to train their models?
With business plans and with the API, no, by default and by contract, as OpenAI and Anthropic state. The documents still reach the provider's servers, though, and some logs are kept for a period, up to 30 days for OpenAI's abuse monitoring. An employee's personal account is another matter, because the employee accepted the terms; that is why you need a rule that forbids it for work documents.
Does a model on your own servers settle GDPR?
No. It removes the external provider and the transfer of data outside Europe, if nobody accesses it from outside, but the legal basis, data minimisation, the impact assessment when the risk is high and above all security remain, and security becomes entirely yours. If a provider runs the server for you, you also need the contract with it as processor.
Can you use Claude or ChatGPT and keep the data in Europe?
Yes, usually for 10% more. OpenAI offers data residency in Europe on the API, on request and per project, or through Azure. Claude in a European region goes through Amazon Bedrock or Google Cloud, because Anthropic's direct API has no European option. A US provider remains subject to the CLOUD Act even with the data in Europe.
What does an AI model on your own servers cost?
A 48 GB L40S GPU rented from a European provider costs 1.40 € an hour, about 1,000 € a month always on, excluding VAT, at the price lists of 30 October 2026. On a machine of your own you pay the purchase, to be quoted by a reseller, and the electricity, which for the card alone reaches about 65 € a month. In both cases there is the work of whoever keeps it running.
When does a model on your own servers pay off instead of the API?
When the documents cannot leave by contract or by law, when volumes are very high and steady, or when a small model is enough for a narrow task. On cost, with Llama 3.3 70B the dedicated GPU costs as much as about 1.5 billion tokens a month paid per use, 68 times an assistant that receives 2,000 questions a month.
What hardware does an open-source model need in a company?
A card with enough memory for the model file plus the conversations in progress. Qwen3 32B at 4 bits weighs 19.8 GB and fits in a 32 GB RTX 5090; Llama 3.3 70B at 4 bits weighs 42.5 GB and fits in a 48 GB L40S with little margin, or across two cards. Which model is enough is shown by a test on your own questions.
Who runs a model installed on your own servers?
You, or whoever does it for you. Besides the application, which is needed in the cloud too, there is the model to update and test again when a new one comes out, the service that runs it, monitoring, backups and, if the machine is on your premises, electricity, cooling and failures. With a rented GPU the machine stays with the provider.
Does Volcanic Minds work in the cloud or on-premise?
On both. We regularly work with OVH, AWS, Hetzner, DigitalOcean, Seeweb, Aruba and Azure, and often on the client's own infrastructure. Between European cloud, national sovereign cloud, your own cloud account or on-premise, the choice is made at the start on regulatory, contractual and budget constraints, not on our convenience.
Cloud or your own servers, with the numbers worked out?
Tell us which documents you want to use, who needs to see them and what constraints your contracts and sector set. The feasibility study tells you which option suits each class of document, what it costs and who keeps it running.
- You won't talk to a salesperson
- NDA before we get into the details
- The code stays yours
Articles on the same topics.
European AI Act who does it really affect?
The EU AI Act doesn't only target those who build the models, but those who use AI in business. What applies from 2 August 2026 and what moves to 2027-2028.
Read
Web Bot Auth: visitors with no eyes
AI agents read your site and convert better than organic, yet they never show up in analytics. How to measure them and verify them with Web Bot Auth.
Read
Generative UI: for humans and machines
Explore how Generative UI and Dual-Interaction UX transform enterprise SaaS by creating adaptive interfaces for human operators and AI agents.
Read