borg Download

Private AI

Every model your team uses, on hardware we own.

One gateway key, model access per person, budgets per team, and a human approval step before an agent acts. The prices are on the page. So is the list of things we have not built yet.

See model pricing Talk about a deployment

In place today

Each line is running in production and checkable from somewhere else on this site.

  • Hardware we ownHarbor images deployed by ArgoCD to our own bare metal. No hyperscaler sits in the serving path.
  • One key for every modelOpenAI-compatible and Anthropic-compatible endpoints over the whole live catalogue, with permissions, rate limits and budgets per team.
  • Prompt content off by defaultCapture is disabled unless a key opts in. Three audits found one opted-in key across the whole fleet and it is ours.
  • A person approves before an agent actsWork is proposed with its evidence and waits. Finished work records who approved it and which model did it.
  • Speed we measured ourselvesMedian time to first token and whole-turn tokens per second, from our own production request logs, refreshed weekly.
  • Plan prices in publicTeam at $500 a month and Business at $5,000 a month are printed on the pricing page, not quoted on a call.

Not in place today

We would rather you read this here than find it out on the fourth call.

  • SOC 2 Type I or Type II
  • ISO 27001 or ISO 42001
  • FedRAMP or StateRAMP
  • A HIPAA business associate agreement
  • An air-gapped install
  • A customer we can name to you
  • An uptime guarantee for the platform API
  • A published price for a private deployment

Where it can run

Three shapes, labelled honestly. One of them you can start today. The other two get written down per deployment, because no customer runs them yet.

Available now

A hosted lane on our metal

Your team gets a key into the gateway we already run. You set who may use which model, what each team may spend, and what gets kept. The machines underneath are ours: Harbor images, ArgoCD, our own bare metal.

  • Live today and billed under a published plan price
  • Permissions, rate limits and budgets per team
  • A usage record you can read per key

Scoped per deployment

A dedicated single-tenant deployment

The gateway can give an account its own key realm with its own access scope, separate from the shared pool. We run that machinery for our own pools, and we deploy our own services with repeatable Helm charts and GitOps. We have not sold it to anyone as an isolation boundary yet.

  • No customer runs this today
  • No install runbook, support response time or price exists yet
  • Scope, boundary and price get written down before anything is signed

Scoped per deployment

Open-weight models on your own hardware

Part of the live catalogue ships under permissive licences, so those models are legally deployable on machines you own. We can tell you which ones and what they need to run.

  • We have no serving stack of record for customer hardware
  • No GPU sizing guide and no benchmark run on someone else's machines
  • Model licences are the vendors' own, not ours to extend

Six businesses we can actually speak to

One per page, each one a business we sell to today or run ourselves. The sectors that need a certification we do not hold are not on this list, and that is deliberate.

Priced on the page, not after a call

You should be able to work out whether this is affordable before you meet anyone. Three things are already public.

Plan prices

Team is $500 a month. Business is $5,000 a month. Both are printed, with what each one includes.

See the plans

A model directory with cited prices

Every live model has a page. Where a vendor publishes a list rate, it is shown with a link to the vendor's own page. Where one is missing, the page says so rather than guessing.

See model pricing

Per-token rates for the same gateway

The gateway behind Borg also sells metered per-token access under the Relay brand, with every rate published.

See per-token rates

What is not priced yet: a private deployment. Enterprise is still a custom number, which is the thing we criticise other vendors for. When there is a basis for that price, it goes on this page.

What we measure, and what we refuse to publish

We have no badge row and no logo wall. What we have instead is a measurement bar we apply to ourselves, and blanks where our own numbers do not clear it.

Published data coverage

These counts show how many models have published measurements or cited prices. They describe data coverage, not response times or request success percentages.

See published measurements by model

How those numbers are made

Speed comes from our own production request logs over a 30-day window ending 2026-10-08, and a metric needs at least 100 samples before it appears at all. A request success rate is published only at 99 percent or better with at least 1,000 requests inside a 7-day window, and errors caused by a client hanging up do not count against a model. 5 models carry a hard-graded coding benchmark we run ourselves. 2 models in the catalogue are still under review and get no page at all.

A vendor that shows you the measurements it had to leave blank is making a claim no badge can make for it.

What we have and have not certified yet

No audit firm has looked at Borg. Nothing below is in progress as a committed, dated programme, and we are not going to imply otherwise. Here is what exists in its place.

SOC 2 Type IINot held
Access control, budgets and a per-key usage record you can read, plus prompt capture that is off unless a key opts in. Behaviour you can verify, not a report you can file.
ISO 27001Not held
Our own hardware and our own deploy path, so there is one place to ask about where a request went.
A third-party penetration test or bug bountyNot held
A published route to report a problem, below, and an internal review before a service ships.
A HIPAA business associate agreementNot held
Nothing. Do not put protected health information through Borg.
A written zero-retention commitment or a data processing agreementNot held
Prompt capture is off by default and audited that way. That is a verified default, not a contract term, and we will not describe it as one.
A named reference customerNot held
Our own numbers, measured on our own traffic, with the method stated and the failures left visible.

Reporting a security problem

There is no dedicated security address for Borg yet. Until there is, send a report to [email protected] with "Borg security" in the subject line and it will reach a person. Please leave sensitive data out of a first message.

Email [email protected]

Start without us, or bring us in

Nothing on this page needs a meeting first. The self-serve path is genuinely self-serve.

Questions a buyer actually asks

Can Borg run inside our own cloud account or our own data centre?
Not as a product you can buy today. We deploy our own services to our own bare metal with Helm charts and ArgoCD, and the gateway can give an account its own key realm, so the pieces exist. No customer runs a single-tenant install, there is no install runbook, and there is no price. If that is a requirement, say so early and it gets scoped and written down before anything is signed.
Do you have SOC 2 or ISO 27001?
No. Neither one, in any tense. No audit firm has examined Borg and we are not going to describe an unfunded intention as a programme in progress. If your procurement process requires either certificate, Borg will not pass it today.
Will our prompts be used to train a model?
Borg does not train models. Prompt content capture on the gateway is off unless a key explicitly turns it on, and three separate audits found exactly one opted-in key across the whole fleet, which is one of ours. That is a verified default rather than a contractual commitment, and we will not call it a contract until one exists.
Can you train a private model on our work?
No. There is no training or fine-tuning pipeline behind Borg. What routing does is choose an existing model for each step of a task. A dedicated lane sends your requests to an existing model; it does not build a new one out of your material.
Are the Borg-branded model names your own models?
No. Borg has not trained any model. A Borg lane name is a routing product: it names which model or set of models a request is sent to, and every model page says plainly whose model is being served.
What does a private deployment cost?
There is no published price, and that is a real gap rather than a negotiating position. Published plan prices cover the hosted lane. A dedicated deployment has no price because nobody has bought one, so the first ones get costed openly with the customer.
Where does our data physically sit?
On our own bare metal, at one site. There is no second region, so Borg cannot satisfy a data residency requirement that names a country we do not operate in.
Who do we contact about a security issue?
Send it to [email protected] with "Borg security" in the subject. There is no dedicated security address yet, and the security page says the same thing rather than pointing you at a form.