Law firms
Client confidentiality and privilege make third-party processing of matter files a serious question. A private AI system lets attorneys search and summarize their own documents without a single page leaving the firm.
Rochester, NY · Remote-first · Regulated industries
Sovereign IT & AI Architecture for Data That Must Stay Private
Law firms, healthcare organizations, and financial institutions want the productivity of modern AI without exposing privileged, protected, or nonpublic data to a third-party API. I design and build private AI systems and the infrastructure under them, so your data, your models, and your logs stay inside your boundary.
- Years in IT
- 28+
- Years in business
- 20+
- Public AI APIs in the data path
- Zero
Built for data that must stay under your control
The same architecture serves three kinds of organization, each with a different reason the public cloud is off the table.
Healthcare organizations
Protected health information carries strict handling duties. Local models can draft, summarize, and answer questions over internal records and policies while the data stays on systems you govern.
Financial institutions
Nonpublic client financial information, examination readiness, and vendor risk reviews all get simpler when no external model provider is involved in processing the data.
Core services
Four connected services take you from a defined data boundary to working, supported systems.
Service 01
Secure Local LLM Deployment
I size, build, and harden a large language model environment that runs entirely on infrastructure you control: a workstation, a rack server, or a dedicated GPU node. You get a working assistant, an access model, and documentation your IT staff can run without me.
- Hardware and model sizing for your users and workload
- Ubuntu GPU nodes with Ollama-based local inference
- Network isolation, authentication, and role-based access
- Audit logging, backup, and recovery procedures
- Model selection and evaluation on your own tasks
- Runbooks and hand-off training for your team
See how the pieces fit in the Project S.P.H.E.R.E. AI infrastructure case study.
Service 02
Private Enterprise RAG Architecture
Retrieval-augmented generation lets a model answer questions from your own documents and cite where the answer came from. I build the full pipeline privately: ingestion, chunking, embeddings, a vector database, retrieval, and a user interface, with permissions that respect who is allowed to see which documents.
- Document ingestion from file shares and archives
- LlamaIndex orchestration with a Qdrant vector store
- FastAPI service layer and a React front end
- Source citations on every generated answer
- Per-matter, per-department, or per-client access boundaries
- Retrieval quality testing before go-live
Retrieval quality, not model size, usually decides whether a RAG system earns trust. Every build includes a test set drawn from your real questions.
Service 03
IT Infrastructure Automation
Most IT teams lose hours every week to repetitive Windows Server, Active Directory, and helpdesk work. I automate the routine with PowerShell, Python, and local AI, with human approval kept in front of every change that matters.
- Windows Server health, patching, and backup verification
- Active Directory hygiene and onboarding workflows
- AI-assisted helpdesk triage and suggested responses
- Read-only first, change-approved second
Service 04
Managed IT Services Advisory, Co-Managed IT & Fractional CTO
Direct senior architecture, escalation engineering, and operational advisory built on 20+ years of owning and operating Managed Service Providers—including leading Computer Service Specialists of New York (CSSNY).
- Co-managed IT & Tier-3/4 escalation for Windows Server, Active Directory, Group Policy, packet-level networking, virtualization, and bare-metal recovery.
- Managed Services operational audits: backup verification pipelines, RMM/PSA automation hygiene, least-privilege access, and disaster recovery runbooks.
- Fractional CTO & AI transformation advisory for regulated law firms, healthcare providers, and financial institutions.
- Links directly to /services/it-infrastructure-automation and /blog/ai-transformation-advisor-vs-fractional-cto/.
How an engagement works
Step 1
Define the boundary
We map what data you hold, who may see it, and which systems may never touch it.
Step 2
Design the system
I produce the architecture, hardware specification, and a fixed-scope plan for review by your team and counsel.
Step 3
Build and harden
We stand up the nodes, load your data, test retrieval and access controls, and document everything.
Step 4
Hand over and support
Your staff gets runbooks and training. Ongoing support is optional and scoped separately.
Why 28 years of infrastructure experience matters for AI
A private AI system is an infrastructure project first. It needs networks that are segmented correctly, servers that are patched and backed up, identity that is managed, and logs someone actually reads. I have spent 28 years running exactly those systems, from enterprise Windows environments and Active Directory to virtualization, networking, and disaster recovery.
That background is why the AI layer I build behaves like production infrastructure and not a demo. It is also why I will tell you plainly when a task does not need AI at all.
Read the full biography and career history of Michael P. Goodman.
Sovereign IT and AI services FAQ
What is sovereign IT and AI architecture?
It is a design approach in which your sensitive data, your AI models, and the infrastructure that runs them stay under your control. Prompts, documents, embeddings, and logs are processed on systems you own or dedicate to your organization, and no public AI API sits in the data path.
Why not simply use a public AI service with a privacy agreement?
For many organizations a contract is enough. For firms that handle privileged legal files, protected health information, or nonpublic financial records, a contractual promise still leaves a third party processing the data. A local deployment removes that third party, which simplifies your risk analysis and your conversations with clients, auditors, and counsel.
Does this make us compliant with HIPAA, GLBA, or attorney-client privilege rules?
No architecture makes an organization compliant by itself. Compliance depends on your policies, your people, and the determinations of your counsel and auditors. A sovereign design removes a major category of exposure and gives you the technical controls, logging, and documentation those reviewers ask for.
What hardware does a private local LLM need?
It depends on the model size, the number of concurrent users, and the response speed you need. Small teams often start with a single workstation-class GPU server. Larger deployments use multiple GPUs or dedicated nodes. Every engagement begins with a sizing assessment so you buy what the workload requires and no more.
Do you work with organizations outside Rochester, New York?
Yes. Michael P. Goodman is based in Rochester, NY and works remotely with clients in regulated industries. Hardware installation can be done by your team or a local partner under a documented build specification.
Who you work with
I am Michael P. Goodman, a Rochester, New York technology architect with 28 years in IT and more than 20 years as a business owner. I led Computer Service Specialists of New York as president from 2014 to 2024. You work with me directly, not with a rotating team.
Start with an architecture assessment
Tell me what data you hold and what you want AI to do with it. I will respond with a clear view of what can run locally, what it needs, and what it should cost to build.