Which legal AI vendors offer on premise or private cloud deployment?

Residency control is not a training commitment, and the top deployment tier proves it. Of the 46 vendors publishing deployment and residency at the highest standard, 20 prohibit training on customer content in the published agreement, 12 state it in policy only, 5 publish no located term or policy addressing training either way, and 5 reserve the right to train. Choosing where data sits and establishing what may be done with it are two separate diligence steps, and the second does not follow from the first.

BigID, Knovos Discovery, Lawpath, LexCheck and Reveal publish deployment and residency at the top of the axis and have no located term or policy addressing training either way. That combination is worth naming precisely because it looks like the opposite from the outside: a vendor that has clearly thought about where data lives reads as a vendor that has settled what happens to it, and the record does not support that inference. The full training picture across the index is on do legal AI vendors train their models on client data.

Whether a vendor will build you a private deployment. This axis measures published material, so a vendor that routinely delivers single tenant or on premise installations under a negotiated agreement and has never said so in public grades on the silence. That is a finding about disclosure and not about capability, and it is dated: a vendor that publishes a deployment page tomorrow is redated the day it does.

The index also cannot audit where processing actually happens. It records what the vendor states and whether the statement distinguishes storage from processing, which is the distinction most residency claims blur. A firm with a genuine sovereignty requirement should treat the published position as the start of the diligence rather than the end of it, and should ask the supply chain question separately, because that is the one the deployment page is least likely to answer.