Bring your own model. We mean that literally.
Community Edition doesn't ship with a bundled inference provider — you choose what sits behind the AI layer. Four supported patterns, one configuration surface: an endpoint and credentials, declared like any other setting, swappable without touching the workflows that call it.
| Pattern | Where it runs | Suits |
|---|---|---|
| local / self-hosted | Entirely within your infrastructure | Data-control maximalists and air-gapped estates |
| private AI gateway | Your existing internal gateway | Organizations that already centralized AI access |
| enterprise-approved | Your contracted cloud AI account | Procurement-approved provider usage |
| other endpoint | Any compatible inference endpoint | Everything else that speaks the protocol |
Two boundaries hold across all four. First, TruSecure's proprietary private inference is never bundled here — that's a deliberate architectural boundary, not a missing feature; it exists in TruSecure GRC, and Community Edition is a different operating model, not a teaser for it. Second, the governance workflows do not change with the provider: the AI proposes, a named person approves, everything is logged — the approval boundary is in the product, not in whichever model you point it at.
Choosing and changing providers is a configuration edit, not a migration. The test request from the install verification runs against whatever endpoint is current, so a provider swap is confirmed the same way an install is: by evidence, not by hope. Credentials live in your configuration, under your secret management — the application stores what it needs to reach the endpoint and nothing more.
The pattern table above is exhaustive rather than illustrative: if an endpoint speaks the protocol, it is supported, whatever the vendor label on it says. That is what model-provider agnostic means here — not a menu of approved names, but an open interface with four documented shapes.
See the full inference architecture