DE EN
High Intent Labs · Orientation

Four Tiers Between Convenience and Control

The question is never "cloud or not". The question is: which data may go where, and which tool belongs on which tier. Below: the ladder, the data classes that decide it, and the full tool matrix, category by category.

As of 16 Aug 2026 · prices are orders of magnitude, not quotes · internal

The ladder

Every tier costs you convenience and model quality, and hands back control over the path your data takes.
Tier 1 Standard cloud

Best models, ready in minutes. No training on your data, DPA in place. Processing mostly on US servers.

Data path: out to the provider, stored there for up to 30 days.
what we run today
from ~25 € / userno operations, no project
Tier 2 Hardened cloud

Same models, tougher contract: zero data retention, SSO, audit log, and EU processing where available (Bedrock Frankfurt, Azure EU).

Data path: out, but nothing stored. Still a trust model.
from ~300 € / monthdepends on contract and usage
Tier 3 Your server in the EU

An open model on rented hardware in a German data centre. You are the operator, the provider is only the landlord.

Data path: stays inside your machine, physically in someone else's building.
from ~890 € / monthHetzner GPU, cancellable monthly
Tier 4 A box in your office

Your own hardware in your own building. No provider in the path, no fallback to the outside, works without an internet connection.

Data path: there is none. Everything stays in the building.
from ~4,700 € one-offafter that, essentially electricity
← easiest start, best model quality, least effort full sovereignty, your own operations →

Sort the data first, then pick the tools

The tier applies per data class, not per company. Almost everyone runs a mix.

Public

Website copy, LinkedIn posts, articles, market research: anything that is published already or is meant to be.
Minimum tierTier 1

Internal

Concepts, draft proposals, roadmaps, internal numbers without personal data, project notes without client names.
Minimum tierTier 1 to 2

Confidential

Client data, contracts, pricing, HR files, anything personal under GDPR, meeting transcripts with names in them.
Minimum tierTier 2, better 3

Privileged

Legally privileged material (lawyers, doctors, tax advisors, §203 German criminal code), crisis files, health data, case work.
Minimum tierTier 3 to 4

The tool matrix

Every row is one building block of the stack. Click a tier column to highlight it.
what we run today The left column tells you what actually matters in that category.
Building block
what matters here
Tier 1
Standard cloud
US provider, DPA, no training
Tier 2
Hardened cloud
zero retention, EU region where possible
Tier 3
Rented EU server
open software, you are the operator
Tier 4
Box in your office
no data path to the outside
Language model The core piece. This is where moving down the ladder hurts most. Claude Pro / Team, ChatGPT Plus, GeminiClaude Claude Enterprise with zero data retention, Claude via AWS Bedrock Frankfurt, Azure OpenAI EU, Mistral (FR) gpt-oss-120b, Qwen3, Llama 3.3 70B, served through vLLM on a rented GPU the same open models, running locally: vLLM, Ollama or LM Studio on a DGX Spark or Mac Studio
Interface & agents Interchangeable. No lock-in lives here, which is the good news. Claude Desktop, Claude Code, ChatGPT appClaude Code Claude Enterprise with Projects and SSO, Claude Code with a ZDR key Open WebUI or LibreChat on the server, Claude Code pointed at your own endpoint via LiteLLM Open WebUI on your own network, LM Studio, Claude Code pointed at localhost
Knowledge base Obsidian is a tier 4 tool out of the box. Only the sync path decides its rating. Obsidian synced via iCloud, Notion, Google DocsObsidian + iCloud Obsidian Sync (end-to-end encrypted, EU servers selectable), Notion Enterprise with a DPA the vault as a Git repo on your own Forgejo or Gitea instance, Nextcloud for files vault on a NAS or the box, synced with Syncthing on your own network, bare repo locally
Database Postgres is Postgres everywhere. Moving it is an afternoon, not a project. Neon (serverless Postgres), Supabase, PlanetScaleNeon, Frankfurt Neon or AWS RDS in Frankfurt with a DPA, encryption at rest, point-in-time backups PostgreSQL + pgvector in a container on Hetzner, encrypted volumes, restic backups PostgreSQL + pgvector on the box, SQLite for small things, encrypted off-site backup
Search index & embeddings The quiet leak: embedding means the full text passes through someone else's model once. OpenAI or Voyage embeddings, Pinecone, managed vector services embeddings through an EU endpoint with zero retention, index in pgvector inside the EU bge-m3 or multilingual-e5 on your own server, pgvector alongside it the same, locally. Run tier 3 or 4 with cloud embeddings and you are effectively on tier 1
Hosting & compute Location, operator and corporate domicile are three separate questions. Cloudflare Pages & Workers, Vercel, NetlifyCloudflare Cloudflare with EU storage locations (D1, R2 with an EU hint), Scaleway, OVH, Open Telekom Cloud Hetzner dedicated or cloud, Docker plus Coolify. Hostinger only for non-critical work (shared hardware) your own server in the office (Proxmox or Docker), reachable internally or through VPN only
CRM The most expensive migration, because every integration hangs off it. Decide early. HubSpot, Pipedrive, Notion table, Airtable HubSpot with EU data residency, Salesforce Hyperforce EU, Zoho EU, Pipedrive EU data centre Twenty, EspoCRM, SuiteCRM or Odoo, self-hosted on Hetzner the same open-source CRM on the box, reachable on the network or through VPN, encrypted backups
Email automation Sending always leaves the building. Recipient addresses and opens cannot be localised. Customer.io, Mailchimp, ActiveCampaignCustomer.io, EU region Customer.io EU region with a DPA, Brevo (FR), CleverReach (DE) Mautic or Listmonk self-hosted, delivery through an EU relay (Mailjet, Postmark EU) Listmonk on the box, delivery still through a relay. Technically there is no further step
Mail & calendar The most expensive move with the smallest security gain. Google Workspace, Microsoft 365Google Workspace Workspace or M365 with EU data regions, DPA, client-side encryption for sensitive content Mailbox.org, Infomaniak (CH), Nextcloud Groupware on Hetzner Nextcloud in-house. Running your own mail server is possible, but it is a job of its own. Often deliberately left on tier 2
Files & storage This is the raw material the brain learns from. Routinely underestimated. Google Drive, iCloud, DropboxDrive + iCloud Drive with an EU region, Tresorit or pCloud with end-to-end encryption Nextcloud or MinIO/S3 inside the EU, Cloudflare R2 with an EU location NAS in the building, encrypted off-site backups with restic, you keep the key
Meeting notes The least obvious leak. A client call is raw material, not a by-product. Granola, Otter, Fireflies, Zoom AI CompanionGranola vendors with EU processing and zero retention, recording off, transcript only Whisper or WhisperX on your own GPU server, summary written by your own model whisper.cpp on the laptop. The recording never leaves the device
Analytics Build it without personal data and the tier barely matters, plus the banner disappears. PostHog Cloud EU, Cloudflare Web Analytics, GA4PostHog EU PostHog EU, cookieless, IP truncated, short retention, no session replay on sensitive pages Matomo, Plausible CE or PostHog, self-hosted on Hetzner internal reporting only, logs stay local. Not meaningful for public websites anyway
Identity & access Permissions are checked before the search runs. The model never decides access. Google sign-in, Clerk, Auth0 Entra ID or Okta with an EU tenant, SSO enforced, MFA for everyone Authentik or Keycloak, self-hosted, groups from your own directory Authentik on the LAN, passkeys, no access from outside without VPN
Passwords & secrets A vault someone else holds the key to is not a vault. Zero knowledge is mandatory. 1Password, Bitwarden, Apple Keychain 1Password Business or Bitwarden Enterprise, EU data region, MFA enforced Vaultwarden, self-hosted, encrypted backups Vaultwarden on your own network, recovery codes offline in a safe
Code & repos Code carries credentials and business logic, not just text. GitHub private, GitLab.comGitHub GitHub Enterprise with EU data residency, GitLab Dedicated EU, secret scanning on Forgejo or Gitea on Hetzner, CI with your own runners bare repos on the NAS. Git does not need a server to work

Six points where the rating usually breaks

These are the places where a setup is tier 3 on paper and tier 1 in practice.
01

Obsidian is not a cloud service

The files sit in plain text on your own disk, with no provider in between. That makes Obsidian itself a tier 4 tool.

Only the sync path gets rated: iCloud is tier 1, Obsidian Sync (end-to-end) tier 2, Git on your own server tier 3, Syncthing on the LAN tier 4. And any AI plugin inside the vault pulls the rating back down to the tier of its model.

02

The weakest link sets the tier

A local model on your own hardware buys you nothing if embeddings run through a cloud API, the transcription tool is listening, or the export lands in Drive.

For each data class, the lowest tier anywhere in the path counts, not the highest.

03

A German data centre is not an EU provider

Location, operator and corporate domicile are three different questions. A US company with servers in Frankfurt is still a US company under the CLOUD Act.

Tier 3 therefore means: your server, your key, a landlord with no access to the content.

04

Nobody runs a single tier

The sensible normal case is mixed: everyday work, research and marketing on tier 1, the material worth protecting on tier 3 or 4.

Forcing everything onto tier 4 means paying in model quality and speed in places where nobody benefits.

05

The knowledge base outlives the model

Models are replaced every six months, the curated knowledge base stays. So keep it in Markdown plus Postgres, both open and portable.

Then changing tiers is a configuration entry, not a rebuild.

06

Operations are the real price

From tier 3 onwards you own updates, backups, restore tests, monitoring and permissions. The 890 € rent is the smaller half of the bill.

If you cannot staff that, tier 2 is a more honest answer than a half-maintained server of your own.

In one sentence

Not everything has to come home. But the core does.

The four tiers are not a maturity path you walk through, they are a shelf you sort your data into. The work is in the sorting, not in the technology.

Step 1Name the data classes: what is public, internal, confidential, privileged.
Step 2Set a minimum tier per class, then hunt for the weakest link in each path.
Step 3Move the core only. Knowledge base first, model last, because the model is the replaceable part.