The runtime every Varahi product runs on. Model serving, retrieval, agent scheduling, budgets and an append-only audit log — installed inside your boundary, on hardware you own.
On-premise is the normal case. The air-gapped install is the default one, not a hardened version of something that was built for the cloud.
Most AI products are a feature bolted onto a service somebody else runs. VarahiBase is the layer underneath. It holds the models, the documents, the agents and the spending — so that the products above it do not each hold their own.
If three teams in your company each build something with AI, without a layer like this you get three copies of the same problems: three sets of model credentials, three half-finished search indexes, three ways of deciding who is allowed to see which document, and three different answers when an auditor asks what happened last Tuesday. None of them written by the person who will have to answer for it.
VarahiBase gives all three the same floor. They ask it to answer a question, search a corpus, run an agent or spend a budget. It does the work and records that it did. The record is the same shape whichever product asked, which is the whole reason the layer is worth having.
It installs on machines you own, in your building or your rack. There is no Varahi cloud in the path, because there isn’t one.
Models arrive as sealed files on a disk and are checked before they are loaded. Nothing is downloaded, because there is nowhere to download from.
Everything it does lands in a log that can be checked by someone who has never had access to the system, using a tool they can inspect first.
Every unit of work in the system — a question to a model, a search, a step an agent takes — goes the same way. There is no second path, no fast lane, and no way for a product to skip a step by being in a hurry.
The request names a person or a service, and a scope — which models, which documents, which tools it is allowed. Then it takes a slice of a budget. No owner, no scope or no budget means it does not run. There is no anonymous work.
A model answers, an index is searched, an agent takes a step. The limit set at admission is enforced here rather than checked afterwards, so a job cannot spend more than it reserved.
The entry is written and made durable before the answer is handed back. If the log cannot be written, the work does not start. A system that can act without recording it is a system whose records are optimistic.
Refusals take the same path. Being turned away for the wrong scope, or for running out of budget, is recorded exactly like a success — because “nothing happened” and “we said no” are different answers, and only one of them is in most systems’ logs.
A product asks for “the default chat model”. An operator decides what that is today. Swapping the model is a configuration change with a review behind it, not a project — and the change is recorded, so a different answer next month has an explanation.
Text, embeddings, ranking, speech and images are all served here, which is why no product ships its own engine.
Drawings, procedures, contracts, mail and tickets, made searchable with a citation attached to every passage that comes back — and the citation opens the original, not a copy of it.
Permission is checked against the person asking, at the moment they ask, inside the search itself. Somebody with narrow access gets their best matches, not the leftovers of somebody else’s.
An agent runs under a named scope with a list of tools it may use and a limit on how long and how much. Anything it cannot undo — sending a message outside the company, moving money, deleting a record — stops and waits for a person.
The approval records who decided, when, and a fingerprint of exactly what they were shown.
Spending is reserved before work starts and settled when it finishes, so a runaway job stops at its limit instead of being discovered in a report. Limits are set per department, per project, per agent.
Running out is a plain answer with a time to retry, not an error. Products are required to handle it, and we test that they do.
Most systems have monitoring: useful, approximate, and quietly dropped when it gets expensive. An audit log is a different thing, and VarahiBase keeps them apart deliberately. Monitoring can be lost without anyone being harmed. The record cannot.
Each entry carries a fingerprint of the one before it, so removing or editing anything breaks the chain. Periodically the whole log is summarised and signed. And the log is never thinned out to save space — a retention policy that quietly deletes evidence is not a retention policy.
You can hand an auditor an export and a small checking tool. It runs on an ordinary laptop with nothing installed and no access to your system, and it tells them whether anything was changed. We would rather they check than take our word for it.
Every one of these is a trade. We would rather state the cost than let you discover it.
Nothing reaches out. Not for a model, not for a licence check, not to tell us how it is going. A component that genuinely must cross the boundary — a mail relay, say — has to declare exactly which host and which direction, and is tested against that list at install.
The cost: features that quietly depend on an internet service do not work here, and we find that out at build time rather than at your site.
The obvious way round is to do the work and then log it. That way, a failure to log arrives after the message has already been sent.
The cost: if the log cannot be written, the system stops accepting work. We think a system that pauses is better than one that acts with no memory of it.
Search begins as ordinary full-text search over whole documents — no embeddings, no chunking decisions, and a query you can read. Each collection has its own set of test questions. When those questions show plain search missing, that collection moves up to the more elaborate pipeline, and you see both numbers side by side.
The cost: it is less impressive to demonstrate. It is also far cheaper to run and far easier to debug at two in the morning.
Agents are useful and they are wrong sometimes. So the system is built so that being wrong is cheap: an agent can read, draft and propose all day, and the moment it wants to do something that cannot be taken back, it stops.
The cost: a person is in the loop, so throughput is bounded by attention. That is the intended shape, not a limitation we plan to remove.
An agent that reads your files will eventually read a file written to mislead it. What an agent is allowed to do is fixed before it reads anything, and nothing it reads can widen that. Text taken from a document cannot become the recipient of a message or the target of an action on its own.
The cost: some genuinely convenient shortcuts are closed off. The attacker’s best case becomes a bad suggestion that a person reads.
The interfaces are the open ones — the common model APIs, the emerging tool protocol, ordinary signing and packaging standards. Each is pinned to an exact version in a published profile, and applications declare which profile they were built against. Standards in this field move fast; naming one without a version is how tools break quietly.
The cost: we adopt a new standard later than the earliest adopters, and we carry two versions while everyone moves.
Runbooks, failure modes, on-call paths and the reasoning behind each decision are handed to your team. The audit export is a plain, documented format with its own checking tool. The models are files you hold.
The cost: it is more work to write down why, and it makes us easier to replace. That is the point.
Each product is a signed package that declares what it needs — which model classes, which document collections, which tools, and which of those tools can do something that cannot be undone. An operator reads that list and approves it before the product is installed. Nothing acquires a capability quietly.
The whole company on one core: mail and files, CRM and outreach, projects and people.
The same runtime cut down for a shopfloor machine, where the hardware is small and the uplink is not there.
The contract is published. A team of yours can build on it without us in the loop, and the same checks apply to what they build.
It arrives on media, not over a wire: the software, the models, the applications, a list of everything with a fingerprint beside it, and the signatures to check that list against. The installer verifies the media, then checks that nothing in it can reach the outside world — and refuses to continue if anything can.
An outbound firewall rule. A VPN back to us. A copy of your data for training. A licence server that has to be reachable — if a licence lapses, serving and the audit log keep working, and only new installations stop.
The interesting question is rarely which model. It is what your data looks like, what the room will not allow, and who has to answer for the result. Scope and duration are set with you once we have seen those. First conversation is with an engineer.