Integration / Self-hosted runtime
Ollama, routed by jurisdiction.
Use Ollama for local and edge inference behind YTT Secunet, so developer laptops, branch servers and test environments follow the same residency policy and receipt format as production.
Ollama is an open-source tool for running open-weight language models on a local machine or server. It downloads model weights, serves them through its own REST API on port 11434 by default, and also exposes an OpenAI-compatible API under /v1, so clients written against the OpenAI SDK can talk to it with a base URL change. It is popular with developers because it runs on laptops and workstations as well as on single GPU servers.
In a YTT Secunet deployment Ollama typically plays two roles. The first is development parity: engineers run Ollama locally, point it at a local YTT Secunet data plane, and exercise the same policy packs, PII masking and receipts they will see in production, without sending test prompts to a hosted provider. The second is edge inference: a branch office, a clinic or a factory site runs Ollama on a local server for low-volume tasks where the data must not leave the building, and YTT Secunet routes only that site's tenants to it.
Two cautions. Ollama's server does not enforce authentication by default, so put it behind a reverse proxy with TLS and a key before registering it, and bind it only to the internal interface. And Ollama also offers models that run on Ollama's own cloud rather than on your machine; YTT Secunet registers an Ollama endpoint as a Self-hosted runtime only for models served locally, and blocks cloud-run model names on self-hosted routes. For sustained production throughput, most teams graduate to vLLM.
| Region or deployment | Location | Jurisdiction |
|---|---|---|
| Customer-chosen location | Developer workstation, Chennai office | APAC / Asia-Pacific |
| Customer-chosen location | Branch server, Munich | EU / European Union |
| Customer-chosen location | Clinic edge server, Lyon | EU / European Union |
- 01
Install Ollama on the host and pull the model you need; bind the server to an internal interface only.
- 02
Place a reverse proxy with TLS and an API key in front of port 11434.
- 03
Register the endpoint in YTT Secunet with jurisdiction and facility, using the /v1 OpenAI-compatible path.
- 04
Restrict the endpoint to the tenants of that site with a tenant selector in the route.
- 05
For local development, run the YTT Secunet data plane container next to Ollama and point your SDK at it with the same policy headers you use in production.
endpoints:
- id: ollama-muc-branch
provider: openai-compatible
upstream: https://ollama.muc.branch.internal/v1
jurisdiction: EU
facility: muc-branch-01
credentials: vault://ollama/muc
models: [llama3.1:8b, qwen2.5:14b]
local_models_only: true
routes:
- policy: eu-gdpr-strict
tenants: [tenant-de-muc-*]
primary: ollama-muc-branch
on_unavailable: reject- local_models_only blocks any model that Ollama would run on its cloud rather than on the registered host.
- Edge routes default to reject on unavailability, because failing over to a hosted provider would move the data off site.
- Receipts from edge sites are batched and anchored in the hourly Merkle tree when connectivity returns.
Is Ollama suitable for production?
For low-volume edge and single-site workloads, often yes. For multi-tenant, high-throughput serving, vLLM is the better fit; YTT Secunet supports both with the same configuration model.
Can developers use Ollama without a YTT Secunet account?
They can run Ollama on its own, of course. Running it behind a local YTT Secunet data plane is what lets them test policy decisions, PII masking and receipts before shipping.
What jurisdiction is a laptop in?
Wherever it physically is, which is why YTT Secunet treats laptops as development endpoints only and never as targets for production tenant data.
Sovereign route ready
Stop risking 4% global turnover GDPR fines on AI inference.
Deploy sovereign, cryptographically proven AI routing in 15 minutes.