Cellule-PRO · Sovereign microsystem

Self-hosted LLM inference :
for organizations that won't hand their data over to the cloud.

A complete self-contained microsystem in a single Docker image. Your data never leaves your infrastructure. GDPR self-service, full traceability, native multi-site cluster.

🎁 PIONEERS 3 first organizations: 2 years free + lifetime pioneer pricing. See offer →

▶ Quick video: the pool and its settings, in 2 minutes

it-admin@your-server — deployment
$ docker compose up -d
✓ cellule-pro started — single image, zero external dependency
✓ no outbound connection
# first-boot wizard:
→ https://pool.internal:8443
# your data never left your network.
✓ GDPR self-service ✓ Traceability & human oversight ✓ Air-gap by default ✓ Protected delivery OpenAI-compatible (opencode, OpenWebUI, Continue.dev) Ed25519 · pgvector · PostgreSQL
Why Cellule-PRO

Your data is your heritage. Keep it at home.

What leaves your company without you knowing

Monday, 8:10 a.m. Sophie, your accountant, has a 40-page contract to summarise before the 9 o'clock meeting. She has heard of ChatGPT. She opens the site, pastes the whole contract — your prices, your client's name, your payment terms — and clicks “Send”. At 8:12 she has her summary. She is delighted.

You will never know. Yet your contract has just crossed the Atlantic. It now sits with a company subject to American law: the Cloud Act allows that country's authorities to demand its data, even when it is stored in Europe. Where is your contract kept? Who will be able to read it? Will it one day help train a machine that answers your competitors?

Sophie did nothing wrong. She wanted to do a good job, faster. Your employees already use artificial intelligence — with or without your permission. The real question is where your documents go when they do — and whom they obey afterwards.

Three scenes you know

The retirement

Jean-Pierre leaves in six months, after 30 years. He knows why that client is fussy about deadlines, how the 2019 dispute was settled, where the right drawing is. On the day of his farewell drinks, all of it walks out with him.

The language barrier

Tomasz, your driver, is Polish. Julie, your dispatcher, is French. They half understand each other, with gestures and rough texts. One day a delivery address is misread: 80 km for nothing, and a client left waiting.

The lost evenings

Your site manager gets home at 7 p.m., then writes his reports until 10. One day, he will go to the competitor who promises he can get home earlier.

Now imagine something else

An artificial intelligence that belongs to you. Not rented from a foreign giant that can change its prices, its terms or its masters overnight — installed in your building, on a server you own, and on the computers you already have, which sleep half the day. The day the Internet goes down, it keeps working.

Sophie summarises her contract in two minutes — and the contract never leaves your walls. Your IT person can check it on your own network equipment: nothing goes out.
Jean-Pierre's knowledge stays in the company: in your documents, procedures and files. His successor asks the question and gets the answer, with the document it comes from.
Julie writes in French, Tomasz reads in Polish. Translated by your own machine, in encrypted messages that even your IT department cannot read.
Your site manager dictates his report on site. He checks it, approves it, and gets home on time.

Not one more gadget: a colleague who never sleeps, never retires, speaks every language of your teams — and never repeats your secrets to anyone. Not to a competitor. Not to a foreign government.

Why in your building, not in the cloud?

Because what makes you valuable is what you know. Your prices, your processes, your clients, your drawings, thirty years of experience: that is your heritage, just like your buildings and your machines. You would not hand the keys of your warehouse to a stranger on the other side of the ocean. Why hand over what you know?

And because your clients already ask for it. Hospitals, water, energy and defence companies, and more and more large clients write it in black and white: “no document may be processed by an online artificial intelligence service.” The day that line appears in a tender, there are two kinds of companies: those that must answer “we can't”, and those that answer “our AI is installed in-house — come and check”. You want to be the second kind.

What it really costs you

A word from the founder

“I created Cellule-PRO because I refuse an idea that is sold to us as inevitable: that a French or European company must hand over its most precious knowledge to a few foreign giants in order to have access to artificial intelligence.

Our companies have built their know-how over generations. It has no reason to drain away, piece by piece, into servers nobody here controls.

Cellule-PRO is designed in France. It is installed at your site, works without the Internet and calls no one. It is your AI, on your soil, under your sole authority. Sovereignty is not a slogan: it is being able to unplug the cable and keep working.”

Founder of Cellule-PRO

Your employees already use artificial intelligence. The only question is: does it work for you, in your company — or does it carry your secrets elsewhere?

Cellule-PRO: your company's artificial intelligence, which stays with you.

Fictional characters. Real situations.

See it in action

Cellule-PRO in two short films

From installation by your IT team to an employee's everyday work — everything stays inside your company.

1. Installation, by your IT team

From download to a running private AI: first-start wizard, workers, federation, knowledge bases.

2. Every day, for your employees

Sourced answers, encrypted messaging with automatic translation, @Cellule in conversations, voice, and the phone app.

CelluleBot, the Cellule-PRO function for your employees: their AI with its sources, and end-to-end encrypted company messaging that translates automatically between languages — on Windows, Linux and Android. Discover CelluleBot →

Who it's for

Built for regulated organizations

If you handle confidential data that you cannot legally or ethically hand over to the cloud, and you still want a powerful internal AI assistant, Cellule-PRO is for you.

privilege

Law firms

Professional secrecy, sensitive client files, contract review, case-law search. Cloud = leak of privilege. Host it in-house.

health data

Hospitals & healthcare

Health data, patient records, clinical protocols. Handing them to an outside host requires certified health-data hosting; keeping them on your own infrastructure keeps you in control.

IP

Multi-site industrial groups

Intellectual property, technical drawings, supplier contracts. Federated cluster across your factories and offices, with no single point of failure.

classified

Defense & government

Classified data, state sovereignty. Can run entirely offline; the Docker image is delivered with no Internet dependency.

The problem

The problem you're living today

✕

Online AI: your data leaves

With an online AI assistant, your questions and documents are processed — and often stored — on the provider's servers. For professional secrecy, health data or industrial IP, that is often unacceptable.

✕

Single-machine tools: a first step

Great for one person on one machine. But no sharing, no company-wide administration, no audit trail: not built for an organisation.

✕

DIY stack = nightmare

Wiring vLLM + pgvector + OpenWebUI + Keycloak + monitoring = 6 months of integration. You're not an AI startup.

✕

The EU AI Act applies

The EU AI Act and the GDPR require you to know what your AI does with your data: traceability, human oversight, impact assessments. That is far easier when everything runs on your own servers.

The solution

Cellule-PRO: the complete sovereign microsystem

1 image

A single Docker image

Private LLM chat + conversational RAG + document RAG + collaborative project spaces + OpenAI-compatible API + admin dashboard + GDPR employee portal. All in one shippable image.

air-gap

No data leaves your network

Closed by default: the server contacts neither us, nor the cloud, nor any third party, and can run fully cut off from the Internet. Any opening (company VPN, your mail server) is your IT department's decision. No phone-home, no cloud licensing.

multi-site

Native multi-site cluster

Headquarters, branches and GPU room federated as one cluster, with signed exchanges (Ed25519) and no single point of failure: if one site stops, the others carry on. Symmetric admin HA — any pool gives you the full view.

GDPR

GDPR rights, self-service

Employees exercise their rights themselves: access, rectification, erasure, portability. Append-only audit trail, cascading anonymisation. Evidence ready for your DPO and your audits.

admin

Admin pilots, zero magic

Every switchover, migration and alert is visible, traced, approvable. Configurable failsafe. No "the AI decided on its own". Your IT team stays in control.

keys

Keys created on your hardware

Each of your servers creates its own cryptographic keys at first start, on your hardware — we never see them. Your licence is checked offline: no licence server, no call to us.

Architecture

Four-layer architecture

A simple mental model that surfaces everywhere: in the docs, the admin UI, the commercial diagrams. Everything flows from this.

Atom

Worker node (GPU/CPU)
or lightweight proxy. Interchangeable, stateless.

Pool

Docker orchestrator: routing, RAG, API, admin. Self-contained and stateful.

Federation

Pools paired by signature (Ed25519). No single point of failure. Symmetric admin HA.

Governance

GDPR audit, offline JWT licensing, incident workflow, failsafe.

Architecture documentation →

Differentiators

What you won't find anywhere else

Beyond private LLM chat and RAG, Cellule-PRO ships an orchestration layer designed for IT departments that want a microsystem still autonomous three years from now — not a POC that becomes unmanageable after six months.

RAID

Multi-site replicated model catalog

Drop a model (drag-drop) on any pool: it replicates automatically across sites through the signed federation. If a site goes down, another takes over with one click — multi-site RAID for your models, no single point of failure, no third-party cloud.

routing

Automatic smart routing

A single API, several specialized models behind it. The pool routes each request to the right model: a Coder for code, a conversational model for chat, a reasoning model for long tasks. The user writes, the pool picks. Zero friction.

memory

Long-term memory — your assistant remembers

Your devs use opencode, Cursor, Continue.dev on Monday, close their laptop, reopen Wednesday on another machine — the assistant still remembers: the bug to fix, the architecture decisions, the project conventions. End any prompt with [MEMORIZE: fact] to plant a fact, then it surfaces automatically next time you ask about it. Each user's memory is encrypted, on your LAN, no --continue needed. All of it stays on your LAN — nothing is sent to the cloud.

auto-tier

Auto-tier workers on heterogeneous fleets

Office PCs, workstations and GPU servers don't have the same power — that's normal. At startup, each worker is measured and receives a model it can run well, never below 7 billion parameters, for answer quality. Your mixed fleet joins without manual tuning.

loop

Self-improvement: your LLM helps your IT team

The OpenAI-compatible API lets your IT team use Cellule-PRO as a sub-agent in their own dev/admin workflow and internal procedure writing. Virtuous loop: your private LLM helps you maintain the system that runs it. Complete sovereignty, near-zero marginal cost.

web UI

Built-in employee web UI — no OpenWebUI needed

Your employees never touch a terminal or a config file. They open a URL, log in, and chat directly: saved conversations, RAG document drag-and-drop, collaborative project workspaces, [MEMORIZE: fact] mode. Project mode = an isolated workspace for a client matter, a patient case, or an audit, with its own dedicated memory. All on your LAN, zero heavy client to install.

API

…and compatible with the tech tools they already use

Your devs prefer opencode / Continue.dev / Cursor? Your data scientists want their Python openai SDK? Some teams already adopted OpenWebUI on Ollama and want to keep it? The OpenAI-compatible API of Cellule-PRO accepts them all via sk-cellule-* tokens. The built-in UI for those who want simple, the API for those who want integration.

Security & data integrity

The questions your security auditor will ask — answered

Law firms, notaries, hospitals: your IT is audited. A stolen laptop, an employee who leaves, someone listening on the network, a site that was offline — Cellule-PRO has an answer for each, built in and tested on a real multi-site cluster.

Our doctrine

Air-gapped by default. Opening to the outside world is your IT department's decision, never ours.

Closed by default. Open if, and only if, your IT decides.

Your AI talks only to you. Not to us, not to the cloud, not to the Internet.

Teams on the road? Your IT opens the door — and keeps the key.

Cellule-PRO installs closed: the server contacts neither the vendor, nor the cloud, nor any third-party service — no telemetry, no online licence check, no update pulled from the Internet. If your people need it on the road, your IT department decides: stay closed, use the company VPN, or, in a next release, turn on the Cellule gateway — hosted by you, with no inbound port, end-to-end encrypted, limited to the phones you have approved one by one. You open it, you see it, you shut it. We see nothing.

replay

A captured message cannot be replayed

Every change exchanged between your sites is signed (Ed25519), dated and single-use: a stale or already-seen message is refused. Nobody can resend an old message to reactivate a deactivated account.

revoke

A revocation reaches every site — even one that was offline

Deactivate an employee or revoke a key: every site applies it, and a site that was switched off catches up by itself when it comes back (measured: under a minute). When in doubt, access stays closed.

GDPR

Deleted means deleted — on every site

A deleted memory, an account erased under GDPR article 17: the deletion is propagated and leaves a fingerprint (no personal data in clear) that prevents any replication from bringing the data back.

key

One key per device, revocable on its own

With CelluleBot, the assistant on the computer and on the phone, each device gets its own key. A computer is paired by a code confirmed by the employee; a phone is approved one by one by your IT, after comparing its fingerprint — never automatically. A lost device is cut off alone, instantly. Next release (Enterprise, in development): phones enrolled by QR code and triple-factor sign-in — password + enrolled phone + fingerprint or face, with no SMS and no outside service.

TLS

Nobody can pose as your server

The admin dashboard and the employee space are served over HTTPS, with your own certificate or the one the pool creates at installation. Exchanges between your sites are signed, and a certificate change is announced before it takes effect: nobody is cut off, nobody can pose as your server.

human

The employee stays the one who decides

The assistant summarizes, prepares and proposes — it never sends and never acts on its own. A document or an email it reads cannot give it orders. Everything stays on your network.

Continuous delivery

Latest releases

Cellule-PRO ships continuously. Here is what recently landed in production, all directly available in the current image.

zero-touch

Zero-touch worker upgrades

Update the pool, and every worker updates itself the next time it connects — as a system service on Windows and Linux, with no one walking from desk to desk. You ship, they catch up by themselves.

VRAM cap

Each machine used at its best

The pool automatically adapts each machine's workload to its graphics memory: no saturation, no manual tuning. Your IT team turns it on once; the pool handles every model.

satellite

Satellite pool in one command, zero wizard

A second site joins your cluster in one command, without leaving your network: no public registry, no Internet. It is paired through a signed exchange and receives your models automatically. No administrator needed on site.

Win · Linux

Workers on Windows and Linux

The same one-line installer for Windows and Linux machines: it detects the system and the graphics card, fetches everything from your own server — never from the Internet — and registers the worker as a service. macOS: planned, not yet validated.

settings

Every setting in the admin dashboard

Every operational setting — memory, queues, audit retention, cooperation between sites — is a labelled switch with a plain-language explanation and a recommendation per profile. No hidden variables, no hand-edited configuration files. Your IT team decides, the pool obeys.

protected

Protected delivery

The core of the pool ships in compiled form: our know-how is protected, your installation stays standard Docker, and nothing changes for your IT team.

rotation

Long-term cryptographic continuity

Licences are checked offline, and our signing keys can be renewed without interrupting your service: a key change never stops your installation. Built for deployments that last ten years or more.

Compare

Cellule-PRO vs alternatives

Criterion Online AI assistant (SaaS) Enterprise cloud AI Single-machine local tool Cellule-PRO
Data stays on your premises No (provider's servers) Depends on region and contract Yes Yes (closed by default)
Built-in document RAG Yes (in the provider's cloud) Build it yourself Basic (one user) Yes (with source citations)
Collaborative project mode Workspaces (depends on plan) Build it yourself No Yes (signed membership)
Multi-site cluster N/A Build it yourself No Native (Ed25519 federation)
GDPR rights for employees Provider's contract Provider's contract Build it yourself Native (self-service)
Incident audit trail Depends on plan Provider's monitoring tools No Append-only log
Runs fully offline (air-gap) No No Yes Yes
Multi-model smart routing Provider's choice Manual (per deployment) Manual model choice Auto (code / chat / reasoning)
Multi-site replicated model catalog N/A Build it yourself No Yes (Ed25519 federation)
OpenAI-compatible API (opencode/Continue/OpenWebUI) Provider API Provider API (largely compatible) Yes (single machine) Yes (sk-cellule-* tokens)
Protected delivery (compiled core) N/A (cloud) N/A (cloud) N/A (open source) Yes
Get started

How to get started?

60-day BETA — zero commitment
You provide a machine (server or VM). We deploy the Docker image, train your IT team, onboard 1-5 pilot employees. At day 60 you decide: continue in production, or stop — we destroy everything, your data was always yours.

1. Discovery call (30 min)

We frame it: your data, your employees, your regulatory constraints, your existing infrastructure. We confirm Cellule-PRO is the right fit (sometimes it isn't — we'll say so).

2. BETA scoping

We define together the perimeter: number of pilot employees, data used, success criteria at day 60. Formal commitment only after cross-validation of the BETA.

3. Installation (2-4h)

Docker image + PostgreSQL + first-boot wizard. We guide remotely or on-site as you prefer. Your IT team follows step by step.

4. Pilot training (2h)

2-hour live tutorial: chat, document RAG, project mode, GDPR self-service. Your employees start using the system right away.

5. 60-day support

Email + video. You ask any question, we tune the config. Goal: your team is autonomous by day 40.

6. Day-60 decision

Review with your IT team: actual usage, employee satisfaction, perceived ROI. Continue in production or clean stop. No pressure.

FAQ

Frequently asked questions

What hardware do we need?

Less than you might think. The Cellule-PRO server (the pool) needs no graphics card: a standard Linux server or virtual machine with 16–32 GB of RAM is enough. The AI models run on the machines you choose — office PCs you already own, workstations or a dedicated server, on Windows or Linux (macOS not yet validated). For reliable answers we only use models of 7 billion parameters or more, so each of those machines needs about 12 GB of memory, or a graphics card with 6 GB or more. Bigger is possible: on our test cluster, a compact AMD Ryzen AI Max mini-PC with 128 GB of shared memory runs a 120-billion-parameter model. Voice and transcription fit on a single 6 GB graphics card (natural voice is part of the Enterprise licence, with guided installation). We size your setup together during the discovery call, based on your headcount and your document volume.

Which LLM is used?

Open models only, running on your hardware: Qwen 3.5 by default, and any model in the standard GGUF format — Mistral, Llama, Gemma, gpt-oss, DeepSeek… For Polish, Bielik (open source, Apache 2.0) is supported. Employees never have to choose: Cellule-PRO picks the right model for each question. No lock-in to a proprietary model.

What if you go away?

Fair question. Cellule-PRO runs entirely on your hardware, with no connection to us: an outage on our side has no effect on your service. Your data stays yours and can be exported at any time in standard formats. Continuity terms (licence duration, what happens if the product stops) are written into the commercial licence.

What if we want to stop?

You export your data (GDPR article 20 native: standard JSON/ZIP export in one click). You stop the containers. Done.

Is Cellule-PRO open source?

No. Cellule-PRO is proprietary software, distributed under a commercial licence. It is an independent product: it depends on no other project, service or network, and never connects to one.

What support do you offer?

Email support with a response time that depends on your plan (from 72 to 24 business hours), crisis video calls, updates delivered as new images. The support level is agreed during the discovery call.

Ready to test?

30-min discovery call to find out if Cellule-PRO meets your needs.
No pressure. If it isn't the right fit, we'll tell you — and point you elsewhere.