Invoice + factsScoped data & context
Private, managed or both · One governed application
Place the workload.
Keep the control.
Run Frozion in your own data center or your AWS, Azure or Google Cloud account.
Restricted work stays on private models inside your boundary. Approved managed models handle only the inputs their task is allowed to use. An outage never permits a route your rules prohibit.
Your own dedicated Frozion instance, deployed in your data center or cloud account.
AP-Review v7Invoice review applicationIdentity · policy · state · versions · evidence
FROZIONExecution FabricGoverned from request to outcome
Your boundaryPrivate
Receiving notePrivate specialist model
Human reviewDurable stateRecord of every change
Separate task · checked before it runs↓
Approved managed routeDraft public help textSeparate public-only input · approved for this task
AllowedEach task runs only where it’s allowedYour infrastructure, your accountOnly the managed models you’ve approvedOutages never bend the rulesConnected decisions and evidence
Private and hybrid deployment across your adoption path
Govern existing agents
The tool calls your agents make are governed inside your own data center or cloud account.
Grow tools into workflows
Each step uses a private or approved managed model, whichever its data allows.
Build native agents
Agents you build use only the models their data is allowed to reach.
Build systems of engagement
Apps for employees, customers, vendors and partners run on your infrastructure, under the same rules.
The problem this solves
A private model is one part of a private application.
Frozion connects the data, tools, people and evidence around a model call to the same workload rules. Your application keeps its boundary through approvals, waits and fallback paths.
The whole path stays connected.
Data preparation, model calls, workflow state and evidence share the controls of the application.
Failover cannot widen permission.
A shortage or outage cannot make a prohibited route available to restricted work.
Choose providers by the work.
Private and approved managed models participate in the same process, using only the inputs each task allows.
01 / Privacy across the application
Privacy that covers the whole decision,
not just the model.
A private model is one part of a private application.
Frozion holds your boundary across the governed path: the data going in, the models and tools, the people who approve, and the record left behind.
The application path
Your boundary holds before and after the model runs.
01
Data & context
Operational records, retrieval, knowledge relationships, calculated facts and the data the decision uses.
Only data this task is allowed to use reaches the model.
Tenant, purpose, classification and source permissions are checked before governed data use.
02
Models & services
Private inference, managed models, deterministic capabilities, API calls and tools.
Each input goes only to a model or service allowed to process it.
Frozion checks the task, permitted inputs and approved route before the call.
03
People & business effects
Review packages, approval, delegated workloads and system-of-record updates.
No governed change reaches your systems without current authority.
Approvals are bound to the exact version reviewed, and policy is checked again right before the change is written.
04
State & evidence
Durable state, documents, protected references and retained execution evidence.
The application record stays in your deployment.
Evidence is tamper-evident and exportable. Reviewers and auditors inspect it within their permitted scope.
Answers to the questions every security review asks
See the connected data path.
Inspect the data, tool calls, decisions and evidence connected through Frozion. A private model alone cannot show you the surrounding process.
Failover cannot break your rules.
A backup is used only if it is approved for the task and its data. Being available is not enough.
Set controls once for every environment.
Authority, contracts and policy live in the application, so a change of infrastructure does not mean rebuilding its controls.
02 / Approved routes, consistent rules
Every task runs only
where it’s allowed to.
The workload’s rules define where it may run.
Frozion chooses from the approved routes for the task and its inputs. If none is available, the work waits or follows its defined alternative. Availability never overrides permission.
Invoice application · placement example
Try it: pick a task and a condition.
Task profile · local example
DP-RECEIPT v3
Classifies the receiving note inside your boundary.
Placement decision
Not evaluatedReady to evaluate.
Pick a task and a condition to see where it may run and what happens next.
Permitted continuation
No route has been selected for this combination.
Example outcome
No placement evaluation recorded for this selection.
Changing a route does not make the input less sensitive.
The public-help task uses only its approved public instruction. It receives no invoice records, excerpts, identities or private context. The permission check follows the actual input.
03 / Outages without rule changes
When a route fails,
the boundary still applies.
An outage never moves data somewhere it is not allowed.
Frozion keeps the task inside its approved boundary. An alternative must fit both the work and its data; otherwise the workflow retains the case while it waits or follows its defined alternate path.
Work waits for an allowed model.
The workflow retains the case while private capacity is unavailable. Restricted inputs stay inside the approved boundary.
The record shows why it waited.An alternative is used only if it qualifies.
The alternative must satisfy the task contract, current authority and permitted inputs before the call.
It must do the job and be allowed to see the data.Or the work takes the path you defined.
Permitted human review, a suitable local calculation or an exception path keeps the unresolved work explicit.
The task still does what it was meant to do.LLM-off paths
Work that does not need a model keeps going when models are down.
Exact queries, calculations and rules continue while their data, authorization and runtime remain available. A step that needs model interpretation waits or takes its defined alternative.
See how work survives failuresCan continueInvoice variance calculation
Invoice r5 and PO r2 remain available locally. Exact arithmetic returns 2.0% variance without model inference.
Needs another pathReceiving-note interpretation
Arithmetic cannot replace the required interpretation. Wait or use the permitted reviewer path; preserve the unresolved obligation.
See which steps keep running without a model, and which take another path.
The workflow makes its exact calculations, model-dependent steps and permitted alternatives explicit. Source data, identity, storage and other services still determine which paths are available in your deployment.
04 / Infrastructure choice, application continuity
Change providers
without rebuilding your controls.
Run each workload where it fits: your private data center, or your own AWS, Azure or Google Cloud account.
Your application keeps its identity, contracts, policy and evidence as approved providers change. Specialist services remain part of the process without defining the whole application.
Your data center.
Restricted work and private models run in facilities you control, colocation included.
Your cloud account.
Frozion runs in your AWS, Azure or Google Cloud account, next to the services you already use.
Approved managed models.
A managed model sees only the inputs approved for its task. Restricted work stays on its private route.
Hybrid.
Private models, managed models, rules and people work in one governed workflow.
Preserve the business processSwap a model or provider.
Add your own providers and services
Swap a model or provider.
Everything around it stays in place.
Identity, delegation, application state, contracts, policy and evidence stay connected. Your team validates the replacement for the task before switching.
See how models are chosenAdd your own providers and services
- Compute & serving
- Your existing infrastructure, approved endpoints and model servers remain connected to the application.
- Cloud-native services
- Provider services you add have clear rules on the tasks and inputs they may handle.
- Network & identity
- Your network controls, enterprise SSO and cloud IAM remain part of the deployment.
- Data & telemetry
- Your data platforms stay the source, and the application’s evidence stays in your deployment.
Plan capacity on what matters
Buy private capacity only for the work that needs it.
We map the work that must stay private alongside tasks that may use approved managed models, calculations or human review. Together, we plan for the whole process, including retries, validation, evidence and running costs.
Cost per governed outcomeThe full cost of a finished result, including failed attempts, escalation and running costs.
Latency to a usable resultTime until the result can be used, including queues, checks, retries and review.
Private capacity utilizationHow busy private capacity runs, and how long work may wait for it.
Outcome qualityValid results, duplicate work and escalations, per workload.
These are the measures we plan with you, not benchmarks or promised savings. Rules engines and your own compute consume resources too.
Connected business evidence
Keep the decision connected to its evidence.
Inspect the workflow, the permitted inputs, policy decisions, approvals and reported outcome together. Evidence stays tied to the business case that used it.
Your environment. Explicit connections.
Deploy in your data center or your own AWS, Azure or Google Cloud account. One deployment can govern connected agents and systems across clouds, with approved inputs and routes for each task.
05 / Questions, answered
Questions security
and architecture teams ask.
Clear answers about private boundaries, provider choice and what continues during an outage.
No. Frozion applies your boundary to the governed path: source data, retrieval, models, tools, human review, state and evidence, not just the model call.
Yes. Each task uses whichever model its data is allowed to reach, so one application can use both without sending private inputs to a public-only task.
The task follows the fallback you set: it waits, moves to another allowed model, or takes a defined path without a model. It never moves to a route its data is not allowed on.
No. Providers differ in capabilities, model behavior, deployment options and handling terms. Your identity, policy and evidence stay connected across them, so switching does not mean rebuilding your controls. Each replacement still needs validation for its task.
Yes. Steps built on exact queries, calculations and rules keep running while their other dependencies remain available. Steps that need a model wait or take their defined alternate path.
No. Where it runs is one part. Frozion adds identity, policy, approvals and a tamper-evident record across the governed path, giving reviewers connected evidence to inspect against your requirements.
Your private data center, or your own AWS, Azure or Google Cloud account. Each organization licensing Frozion runs its own dedicated instance.
Your workload. Its boundary. One application.
Choose where AI runs.
Keep every rule in force.
Bring one sensitive workload. We’ll map where its data goes, show where it is allowed to run, and show what keeps working when a model is down.