Sovereign Desk is a private AI workspace that runs on hardware installed in your office. Document review, intake triage, and drafting — with zero bytes sent to any cloud vendor, and a request ledger you can hand your malpractice carrier.
ABA Formal Opinion 512 put the duty on you, not the vendor: before you put client information into a generative AI tool, you have to understand where it goes and who can see it. "We don't train on your data" is a contract term. A contract term is not a control. You cannot audit it, your carrier cannot verify it, and your PE-backed or healthcare client's security questionnaire will not accept it.
A client asks where their file was processed. With a cloud tool the honest answer is "a data center I have never seen, operated by a company I have no contract privity with." That sentence has cost firms engagements.
Per-seat legal AI runs $180–$250 per user per month and rises every renewal. A nine-person firm is at roughly $24,000 a year, forever, for software it does not own and cannot inspect.
The data-processing section of most vendor MSAs permits subprocessors outside Colorado and reuse of your data "in de-identified form." Firms sign it because the clause is on page nine and the demo was good.
Sovereign Desk is a workstation-class inference server, a hardened local application, and a Colorado-specific rules layer — installed on your desk, on your network, under your lock.
One quiet appliance in your server closet or under a desk. Models resident on local storage. No license phone-home, no account, no subscription that can be revoked.
Nothing to learn. Drop in a lease, a CP2000, an intake email. Review, triage, and drafting are three tabs. Works on the machines you already have.
Every request the software makes is logged and classified LAN or WAN. Export it as JSON for your carrier, your client's security review, or your own peace of mind.
When a PE-backed client or a bank sends the vendor-security packet, you answer it in one page instead of forwarding it to a vendor and hoping. Firms win institutional work on this answer alone — it is the difference between "we use a tool" and "we operate the system."
Governing law, auto-renewal windows, uncapped indemnity, blank placeholders, missed deadlines — flagged with the exact quoted span, in about 15 milliseconds, before any model is involved. The model is the second opinion, not the only one.
Every inbound message is classified, conflict-checked against your client list, and put on the Colorado limitations clock automatically. The 300-day CADA charge and the 21-day CP2000 window get calendared the hour they arrive, not the week someone gets to it.
Not a video. Not a mockup. The workspace below is the same build that ships, loaded with five sample documents and four sample intakes. Click through it — and note the egress counter in the top right.
Hardware is included and yours. Setup is a fixed fee, not an estimate. If you cancel the monthly, the machine keeps working — you lose support, model updates, and clause-library maintenance, not your software.
Cloud legal AI at $225 per seat: $24,300 a year, rising. Two overflow document-review engagements a quarter at $4,500: $36,000 a year. Sovereign Desk Firm, all in, year one: $53,300 — and $28,800 every year after, with the hardware already paid for. You are ahead by roughly $7,000 in year one and $31,500 in year two before counting a single recovered hour.
For the work this does — first-pass issue spotting, clause extraction, intake classification, and drafting from your own precedent — yes, and you can test it before you buy. What it is not is a research substitute: it does not have a case law database and it will not shepardize anything. Keep Westlaw or Lexis for research. Sovereign Desk replaces the AI add-on you are paying for on top of them, not the primary research subscription.
The same thing that happens when a first-year is wrong: an attorney catches it. Half of the product is deterministic — the rules engine that finds a 180-day auto-renewal window or an uncapped indemnity is regular code with a quoted span, not a model guess, and it runs even with the network unplugged. The model layer is labeled as a second read, never as an answer.
I do, remotely, and I am the only person with access. The monthly covers OS and model updates, clause-library maintenance, and support. If you cancel, the appliance keeps running the last installed build indefinitely. There is no kill switch, because a kill switch would defeat the entire premise.
Two visits. The first is 90 minutes to see your network and your document workflow. The second is a half day: rack or place the appliance, load your precedent into the clause library, and train your staff — which takes about 40 minutes because it is three tabs in a browser.
Version one is paste, drop, and upload — deliberately. It works with NetDocuments, iManage, Clio, a shared drive, or a scanner, because it does not integrate with any of them. Direct connectors are quoted per firm once we know what you actually run.
Three ways. The request ledger inside the app logs every outbound call and marks anything non-private in red. Your own firewall can be set to deny the appliance any route to the internet, and the software keeps working. And you can watch it run with the WAN cable pulled during the walkthrough — that is usually the moment the conversation ends.
Send one contract and one intake email. I will run them through a live appliance on the call and you will see the finding list, the limitations clock, and the empty egress counter at the same time. If it does not find something you care about in the first document, we stop there and I will tell you so.
Denver, Colorado · installs within 90 minutes of the Front Range