The model is the easy part.
Keeping your data in-house
is where projects break.
Private RAG, AI agents, and document processing that run on infrastructure you control, designed and hardened by a security engineer, not stitched together from opaque cloud APIs. Twenty production systems stand behind the patterns.
Twenty production systems. One engineer. Running infrastructure, not mockups.
Self-hosted on European infrastructure. Every number below maps to working systems, case studies, or reusable tooling in the fleet.
Eight patterns already tested in production.
Not a generic service menu. These are the patterns the fleet keeps reusing across private AI, RAG, agents, documents, and automation.
Semantic Document Search
Production RAG over enterprise content, SOPs, manuals, contracts, policies. Hybrid retrieval, reranking, source citations on every answer. Document-aware chunking that respects clause and section boundaries, OCR fallback for scanned PDFs, and schema-validated answers so the model can't make up a clause that isn't in the source.
Custom-Trained Models
Domain-specific LoRA adapters trained via LlamaFactory, merged + GGUF-converted, served through local Ollama. Specialised models per app.
Multi-Step Workflows
Classify, route, draft, dispatch, agentic workflows built around stateless reducers and event logs. Observable, resumable, idempotent on retry.
AI in Business Apps
AI threaded into the apps people already use, semantic search in CRMs, copilot panels in dashboards, automated rollups in reports. Routes through one shared CLI bridge.
Self-Hosted Fleet
20+ Docker apps in a self-hosted fleet, per-app networks, hardened containers, log rotation, health checks. No vendor lock-in by construction. Each app owns its Postgres 16 schema and least-privilege DB user, capabilities dropped at the container, NextAuth v5 or hardened custom JWT depending on the workload, the same hygiene at app 20 as at app 1.
Security as a First Concern
Security engineering underneath the AI work, secrets in env-only, capability-dropped containers, prompt-injection defence, audit trails. Not bolted on after.
Prototype-to-Production
A working Docker prototype in about a week, then hardened into production over the following weeks. Every system in this portfolio started that way.
Voice & Audio AI
Live transcription, offline dictation, meeting copilots. On-device whisper.cpp + Electron tray, audio never leaves the laptop.
What I built.
End-to-end.
Production systems designed, deployed, and operated end to end. Clear architecture, observable runtime, and no black-box service hiding in the middle.
See the portfolio →Real systems, not slides.
Six of the twenty systems, each with its own case study: architecture, decisions, what went wrong.
LLM Fine-TuningLoRA adapters trained with LlamaFactory, merged, GGUF-converted, served via local Ollama.
Pension AIMonte Carlo retirement planning over real holdings, pgvector retrieval underneath.
Tax Document AIOCR + LLM bookkeeping for SMEs, scanned receipts into clean, queryable records.
AI-Integrated CRMSemantic search and a copilot panel inside a working CRM, routed through one bridge.
Meeting CopilotLive-transcribed desktop assistant, whisper.cpp on-device, audio never leaves the laptop.
Quant Research TerminalLive IBKR market data, signal scanning, a trade journal, and an AI process coach.
What landed this quarter.
Production work moves carefully. This is what changed in the last few weeks.
Shared infrastructure across the fleet.
Twenty apps do not run in isolation. They share reusable infrastructure built once and improved across the fleet.
Claude Max or local Ollama, per app.
A single Node HTTP server on the host (127.0.0.1:7777) shells out to claude -p so any of the 17 wired apps can route LLM calls through my Claude Max plan, or fall back to local Ollama. One env var flips the provider per app.
One knowledge service, many collections.
Qdrant on 127.0.0.1:6333 with nomic-embed-text (768-dim) reached through the bridge, auto-chunker, dedup-by-hash, reranker, per-app collection naming. CRM, pension, tax, cyreg, and the doc-AI trio all use it.
Specialised models per domain.
Custom-trained LoRA adapters built with LlamaFactory, merged + GGUF-converted, and pushed to local Ollama via a Modelfile generator. Each app picks the model that fits, security-tuned for fwchange, doc-tuned for the legal/maritime/construction trio.
The other half of the practice.
rogueai.de is the AI portfolio; the enterprise network-security work lives on its own site: firewall change management, NIS2 readiness, multi-vendor migrations, and KRITIS programmes.
Visit fwchange.com →Frequently asked.
Direct answers to the things people ask first.
Notes from the work.
The blog tracks what is getting built and what gets in the way: RAG, agent design, LoRA training, AI-search visibility, and the EU AI Act in practice. Written from production work.