How to Build a Private AI Assistant for Your Business

"Private" is one of the most misunderstood words in business AI. Some owners mean "nobody outside the company can use it". Some mean "the AI provider must never see our data". Some mean "everything must run on a server in our office in Victoria Island". These are very different requirements with very different costs, and choosing the wrong level either wastes money on hardware or leaves confidential material flowing somewhere you did not intend.

This article defines the levels of privacy properly, walks through the three deployment options with their trade-offs, gives a decision framework for choosing one, explains how to build the assistant once the level is chosen, covers what changes for Nigerian businesses under the NDPA 2023 and with unreliable power, includes a labelled hypothetical example and indicative costs. It is about privacy and control specifically; the functional design of assistants for owners, staff and documents is covered in their own articles.

What "private" actually means: four levels

Privacy in a business AI assistant is a spectrum with four practical levels. Naming the level you need is the single most important decision in the project, because it determines cost, architecture and what your provider contracts must say.

Most Nigerian businesses that say they want "a private AI" need Level 2. Firms handling legal, medical, financial or government data may need Level 3. Level 4 is justified when regulation, contract or a board decision requires that data never leave your control, and when the business can afford to run and secure the infrastructure.

The three deployment options compared

The four privacy levels map onto three deployment options. Each has a distinct profile of cost, capability, effort and control.

An important nuance: "self-hosted" does not have to mean "a server in the office". A dedicated cloud server that only your team administers, with the model running inside it, is self-hosted in every meaningful sense and avoids the power, cooling and physical security problems of on-premise hardware in Nigeria.

Decision framework: which level does your business need?

Answer these questions honestly, in order. The first "yes" usually tells you the level.

1. Does a regulator, a client contract or your board explicitly require that data never leave infrastructure you control? If yes, Level 4 (self-hosted, preferably on a dedicated cloud server). If no, continue.
2. Do you process highly sensitive categories at scale, such as health records, legal case files, financial account data or government information? If yes, Level 3 (private cloud instance) is the prudent default. If no, continue.
3. Do you need written assurance that the provider will not train on your data and will delete it promptly? If yes, Level 2 (business or enterprise API tier with a data-processing agreement) is sufficient for most purposes.
4. Is your main concern simply that competitors or the public cannot use your assistant or see your documents? If yes, Level 1 with strong authentication and a well-controlled knowledge base is enough.

Two cautions. First, "we would prefer" is not "we require"; over-specifying privacy is the most common way Nigerian AI projects become unaffordable. Second, privacy of the model is only one part: your own database, logs, backups and staff access usually leak more than the model provider ever would.

Step-by-step: building the private assistant

The core steps are: classify your data, choose the privacy level, select the deployment, build the knowledge base and access controls inside that boundary, minimise what the model sees, log and encrypt, test the boundary, then document it. Each step:

1. Classify the data the assistant will touch. Public, internal, confidential, restricted (health, legal, financial, personal). This drives everything else.
2. Choose the privacy level using the framework above, and write it down as a requirement, not a preference.
3. Select the deployment. For Level 2, a business or enterprise API tier with a signed data-processing agreement. For Level 3, a frontier or open model hosted inside your own cloud account in a chosen region. For Level 4, an open-weight model on a dedicated GPU server (cloud or on-premise).
4. Build the knowledge base inside the boundary. The vector store, document store and logs must live in the same privacy boundary as the model; a self-hosted model with a knowledge base on a third-party service defeats the purpose.
5. Add identity and role-based access. Single sign-on where available; retrieval filtered by role in code; personal-data lookups restricted to the authenticated user.
6. Minimise what the model sees. Send only the retrieved passages a question needs, not whole documents; redact or tokenise personal identifiers where the task does not need them.
7. Encrypt and log. Encryption at rest and in transit, an audit log of queries, retrievals and answers, and a retention policy for the logs themselves.
8. Test the boundary. Trace a sample request end to end and confirm where every byte goes: interface, backend, model, knowledge base, logs, backups, monitoring tools.
9. Document the setup for NDPA accountability: data categories, processing purposes, provider terms, retention, access roles.
10. Review quarterly. Provider terms change, models improve, and staff roles shift.

Where the data actually flows (and where it leaks)

Business owners tend to focus on the model provider and ignore the other five places data goes. A private assistant is only as private as its least controlled component.

• The interface: WhatsApp messages pass through Meta's platform; Slack and Teams messages pass through those vendors. If the interface is a third-party service, the conversation is visible to it regardless of where the model runs. A private web app avoids this.
• The backend and orchestration: the code that receives messages and calls tools runs somewhere; make sure it is inside your boundary.
• The knowledge base: vector databases and document stores hosted as third-party services are outside your boundary unless contracted.
• Logs and monitoring: error-tracking and analytics tools often capture full request content by default. Configure them to exclude it or host them yourself.
• Backups: database backups containing conversations and documents must be encrypted and stored within the boundary.
• Staff devices: an assistant that copies confidential answers into personal WhatsApp accounts on personal phones has leaked, whatever the server does.

For Level 3 and 4 setups, draw the data-flow diagram and keep it current. It is also the document an NDPC audit or an enterprise client's security questionnaire will ask for.

What changes for Nigerian businesses

Building a private AI assistant in Nigeria is shaped by four realities: the NDPA 2023 and sector rules on data handling, the unreliability of power for on-premise hardware, USD costs under naira volatility, and the scarcity of local skills for running models.

NDPA 2023 and sector rules. The Act sets obligations on lawful basis, minimisation, security and, in some cases, cross-border transfer of personal data. Sector regulators (for example in banking and health) may add their own data-handling expectations. A private deployment can make compliance easier to demonstrate, but it does not replace the need for a documented basis and policies. Verify current NDPC guidance and sector rules; this is not legal advice.

On-premise hardware and power. A GPU server in an office in Lagos or Abuja needs stable power, cooling and physical security. Generators and inverters make it possible but expensive; a single overheating event can destroy the hardware. For most businesses wanting Level 4, a dedicated cloud server administered solely by your team is the practical choice.

USD costs. Enterprise API tiers, private cloud compute and GPU rentals are billed in dollars. Reserved capacity and smaller models for routine tasks reduce the bill. Budget in naira with a buffer for exchange-rate movement.

Skills. Running and securing models yourself requires cloud and infrastructure expertise that is in short supply. Factor in either training or a support arrangement.

Clients' expectations. Nigerian firms serving banks, multinationals and government increasingly face security questionnaires. A documented private deployment can be a commercial asset, not just a cost.

Example (hypothetical): a law firm in Lagos

Example (hypothetical): A mid-sized commercial law firm in Lagos wants an assistant that lawyers can ask about the firm's precedents, past opinions and current matters, and that can summarise lengthy agreements. Client confidentiality is non-negotiable; several client engagement letters prohibit disclosure of matter information to third parties.

The firm classifies matter files as restricted and precedents as confidential. It concludes that a Level 3 deployment satisfies its obligations: a strong model hosted inside the firm's own cloud account in a chosen region, with the knowledge base, logs and backups in the same account, and a written record that no provider staff have access. The interface is a private web app rather than WhatsApp, so conversations never pass through a messaging platform. Access is by matter team: a lawyer can retrieve only from matters they are assigned to. Monitoring tools are configured to exclude request content.

The firm documents the data flows, the lawful basis and retention, and uses that documentation to answer client security questionnaires. It revisits whether a Level 4 self-hosted model is necessary after a year, once usage patterns and costs are clear. This is an illustrative scenario, not a Linestech client result.

How much does a private AI assistant cost in Nigeria?

The cost of a private AI assistant in Nigeria depends far more on the privacy level than on the assistant's features. The figures below are indicative 2026 ranges; actual quotes vary with scope, vendor, hardware prices and exchange rate.

The assistant's functional build (knowledge base, tools, interface) is largely the same at every level and is the smaller part of Level 3 and 4 budgets. Ask vendors to separate functional build, privacy infrastructure, and recurring costs. Compare two or three written quotes on identical privacy requirements, and ask each vendor to draw the data-flow diagram as part of the proposal.

Mistakes to avoid

• Choosing Level 4 because it sounds safest. It is the most expensive and hardest to run, and a badly secured self-hosted server is less private than a well-contracted cloud API.
• Private model, public knowledge base. Hosting the model yourself and the vector database on a third-party service moves the problem, not the risk.
• Forgetting the interface. Running a private model but talking to it through a third-party messaging platform sends every conversation through that platform.
• Default logging in monitoring tools. Analytics and error-tracking tools capturing full prompts is the most common silent leak.
• On-premise hardware without power planning. Generators, inverters, cooling and physical security are part of the cost.
• No written requirement. "Private" must be defined in a document with data categories and the chosen level, or the vendor will define it for you.
• Treating privacy as a one-time build. Provider terms, models and staff roles change; review quarterly.

Conclusion

Building a private AI assistant starts with defining "private" precisely: access-private, contractually private, infrastructure-private or fully self-hosted. Most Nigerian businesses need Level 2 with a good data-processing agreement, a private knowledge base and role-based access; regulated firms may need a private cloud instance; only firms with hard data-residency mandates and the budget to run infrastructure should self-host, and even then a dedicated cloud server usually beats an office rack. Whatever the level, trace every data flow, including interface, logs and backups, and document it for NDPA accountability. Indicatively, budgets run from around ₦2,000,000 to well over ₦15,000,000 depending mainly on the privacy level rather than the features.

If your business handles sensitive client, patient or financial data and you need to decide which privacy level is genuinely required before building an assistant, Linestech can help you classify your data, choose the deployment and design the boundary around it.

Frequently asked questions

Does using a cloud AI API mean the provider trains on my data?

It depends on the tier and terms. Consumer products may use inputs to improve services unless you opt out; business and enterprise API tiers from major providers generally state that inputs are not used for training and are retained only briefly. Read the current data-usage terms for the exact product you use, and get a data-processing agreement where sensitive data is involved.

Can a private AI assistant run on a server in our office?

Technically yes, using an open-weight model on a GPU server. In Nigeria, the practical obstacles are power stability, cooling, physical security and the specialist skills to operate it. A dedicated cloud server that only your team administers delivers the same data control without those problems and is the usual recommendation.

Are open-weight models good enough for business use?

For many tasks, such as answering from a knowledge base, summarising documents and drafting routine text, strong open-weight models perform well. Frontier hosted models still lead on the hardest reasoning tasks. Test your actual use cases on a candidate model before committing to a self-hosted setup.

Is a private assistant required by the NDPA 2023?

The NDPA does not mandate a particular architecture. It requires lawful basis, data minimisation, security, accountability and care with cross-border transfers of personal data. A private deployment can make these easier to demonstrate, but a well-contracted cloud API with minimisation and good access control can also comply. Verify current NDPC guidance and consult a qualified adviser.

How does a private assistant differ from the internal company assistant or business assistant?

Those articles describe what an assistant does for staff or owners. "Private" describes how and where it processes data. Any of those assistants can be built at Level 1, 2, 3 or 4; this article helps you choose the level and build the boundary around whichever assistant you need.

Can we start with a cloud API and move to self-hosted later?

Yes, if the assistant is designed with the model behind an abstraction layer and the knowledge base is portable. Starting at Level 2 and migrating to Level 3 or 4 when usage, budget or requirements justify it is a sensible path. Keep vendor lock-in low by owning your data formats and code.

What should we ask a vendor about privacy?

Ask for the data-flow diagram, the model provider's data-usage terms, where the knowledge base and logs live, how monitoring tools are configured, how role-based access is enforced, what is encrypted and where backups go. A vendor who cannot answer these clearly is not building a private assistant.

Sources and further reading

Figures, platform rules and regulations change. These are the primary references behind this article and the places to check before you act on it.

• Nigeria Data Protection Commission (NDPC)
• OWASP Top 10
• OpenAI platform documentation
• Anthropic developer documentation