Four ways to run AI on data that cannot leave.

If you hold CUI, ITAR, PHI, or privileged material, you have four realistic ways to put a language model in front of it. You can license Microsoft 365 Copilot inside a GCC High tenant. You can buy a system that runs on hardware you own. You can have your own team build one. Or you can put per-seat AI software on each person’s laptop.

So this page states what each option genuinely does well, sources the facts about it to the vendor’s own documentation rather than to our characterisation of it, and then says plainly where we are the wrong purchase.

One thing to settle before the table makes sense. These four do not differ mainly in features. They differ in what kind of boundary they give you. Copilot in GCC High gives you a contractual and configurable boundary, backed by real federal accreditation and real personnel screening. A per-seat laptop tool gives you a device boundary, one per user. A system on your own hardware gives you a physical boundary you can put a packet capture in front of. Which of those satisfies your obligation is a question for your security program, not for a vendor.

What it genuinely gets right, in Microsoft’s own words rather than ours: prompts, responses, and Microsoft Graph data “aren’t used to train foundation models.” Copilot “respects your identity model and permissions, inherits your sensitivity labels, applies your retention policies, supports audit of interactions” — meaning an organisation that has already invested in Purview gets governance an on-premises stack has to rebuild from scratch. Microsoft staff have no standing access to GCC High production, and temporary elevation requires screening against US citizenship, a seven-year criminal history check, an FBI fingerprint check, and the OFAC, Bureau of Industry and Security, and DDTC Debarred Persons lists. That is a substantive ITAR personnel control, and anyone implying Microsoft is careless here is not worth listening to.

There are three things in Microsoft’s own documentation a CUI or ITAR buyer should read before signing, and none requires an adversarial reading.

The support channel is outside the boundary. Microsoft’s service description states that GCC High and DoD support “isn’t included in the service accreditation boundary and doesn’t provide FedRAMP, DOD SRG, ITAR, IRS 1075, or CJIS data handling compliance assurances,” and in the same section reminds customers “not to share any controlled, sensitive, or confidential information with customer support personnel as part of your support incident when using Office 365 GCC High/DOD, at least until you confirm the support agent’s authorization to view or access such data.” Read it as written: the accreditation does not extend to the support channel, and clearing an individual agent is a step your people take themselves, mid-incident, at the moment something is broken and they most want to paste in what they are seeing.

Web grounding is a policy setting, not an architectural constraint. It is off by default in government clouds — correctly. But an administrator can enable it, after which individual users get a toggle that defaults on. Microsoft documents that the generated search query then goes to Bing, that Microsoft acts as “an independent data controller” for those queries rather than a processor, that the Data Protection Addendum “doesn’t apply to the use of generated web search queries,” and that the query “may be informed by data within a Microsoft 365 document.” The whole file is not sent; themes drawn from it can be. The question is not whether the default is safe — it is whether your boundary can depend on a setting one administrator can change.

GCC High is not IL5. Microsoft describes it as assessed against NIST SP 800-53 at a FIPS 199 High categorization, demonstrating “equivalency to IL4.” Only the separate Office 365 DoD environment is certified at SRG L5, and only DoD entities may purchase it. Buyers who assume GCC High equals IL5 are mistaken, and it is better to learn that here than in an assessment.

Microsoft itself concedes the lag: “Feature availability may differ; Release timing typically lags behind commercial environments; Third-party integrations are more restricted in higher-isolation environments.” And the isolated tenant carries a collaboration tax Microsoft documents plainly — GCC High users can share only with other GCC High organisations.

When GCC High is the right answer, and you should buy it instead of talking to us: you are already in a GCC High tenant, you have no air-gap requirement, and the value you want is Copilot inside Word, Excel, Outlook and PowerPoint reasoning across your mail, calendar and files. In that situation Copilot is one add-on line item — no capital purchase, no refresh cycle, no facilities work, no operations headcount. We cannot offer Office-native authoring or Graph-wide organisational context, and we are not going to pretend the browser is the same thing.

There is no server, no rack, no power and cooling review, no deployment, and no acceptance test. The market floor is genuinely $0 — LM Studio dropped its commercial-use licence requirement in July 2025, and AnythingLLM, GPT4All, Jan and Ollama are free and open source. Commercial products exist above that; Msty publishes $149 per user per year. Any page arguing that per-seat local AI is expensive would be wrong.

Two things bound it, and both are structural rather than fixable by a better release.

Silicon. Laptop silicon bounds you to small models. Our measured record is 43.6 tokens per second on a 72B-class model on an H100-class GPU. That is a different class of work.

Shared retrieval. This matters more than speed. In a standalone per-seat deployment, each laptop holds its own copy of the corpus. There is no shared index, no central permission model, and no single audit log. You cannot answer “who queried which document, when” from one place. You cannot enforce document-level permissions centrally. And you cannot revoke a departing employee’s embedded copy of the document set. A shared system has one index, one permission model, one log — which is exactly what a CMMC, ITAR, or HIPAA assessor asks about. Some products offer an optional in-network relay; the limitation above describes the standalone deployment, which is how most are actually bought.

We are also not going to claim a per-seat vendor leaks. We have not captured their traffic and neither, probably, have you. The distinction we will make is about method of proof: their zero-egress story is a stated property of the software, and ours is a test run at your firewall with your network team reading the output. If a per-seat vendor will run that test at your site, that is a good sign and you should take it.