Private models or an API: a frame for Singapore teams

Singapore teams sit between strict customers and a global catalogue of APIs. The catalogue is excellent and, for many tasks, correct. It is the wrong default when the corpus is contracts, staff records, unpublished financials, or anything a counterparty would not want in a vendor’s training story, even if the vendor promises otherwise.

We use a short frame. What is the worst sentence that could leak, and to whom? Does the task need today’s weights or a stable one you can freeze? Is the user inside your network? Can you tolerate a region you do not operate? If the answers are boring, use an API and spend your effort on retrieval, evaluation, and product. If they are not, put the model where the data already is.

Personal data adds a legal question we will not pretend to close for you. We design so the estate is explicit: where it is stored, who can query it, what is logged. We will tell you when the question needs counsel rather than an engineer.

Hybrid is often the honest architecture: private retrieval, a small local model for the sensitive path, and a larger API for the public one. The mistake is to hide the fork. Users and auditors should be able to see which path a request took.