Private or VPC hosting is not a PDPA checkbox. For a Singapore buyer choosing between a public multi-tenant API, a VPC / private-endpoint hosted model, and a dedicated or self-hosted private LLM, the decision turns on isolation, residency, who can access prompts / weights / logs, and egress — not on the word “private” in a sales deck. Ask those four before production personal data goes into prompts.
Educational only; not legal advice. Confirm hosting, residency and data-protection wording with Singapore counsel before you sign.
Who this is for, and who should skip it
For: Singapore CIOs, CTOs, CISOs, heads of data, procurement and legal who are shortlisting private AI or enterprise LLM hosting and need a buyer checklist that proves tenancy, network isolation, residency binding, vendor staff access and egress controls — before the pilot becomes production.
Skip if: you need logging and retention design under PDPA — see LLM output logging and retention for Singapore buyers; RAG grounding failure modes — see retrieval grounding failure modes for enterprise RAG in Singapore; or production agent controls — see AI agent governance Singapore production checklist. This article does one job: where the model runs and which questions prove isolation, residency, vendor access and egress.
Three deployment patterns in plain language
1. Public multi-tenant API. You call a shared endpoint. Compute and often storage are shared across customers under the vendor’s tenancy model. Convenience is high; leverage is the contract, region selection, retention toggles and egress settings the vendor exposes—not a private network you control.
2. VPC or private-endpoint hosted. The model endpoint is reachable only from your cloud network (or a private link into the vendor’s network). You usually still run on vendor-managed GPUs and control planes. Network isolation improves; shared control-plane and support-access questions remain.
3. Dedicated or self-hosted private. Dedicated hardware or a tenant-isolated stack you operate (or have operated for you) inside your accounts / colo / on-prem. Highest operational load; strongest chance to bind residency, keys and admin access to your runbooks—if you staff that work.
None of these patterns automatically satisfies PDPA. They change where and who can touch prompts, embeddings, fine-tunes and logs. Pair the pattern with cloud infrastructure landing-zone decisions rather than treating “private LLM” as a SKU alone.
PDPA framing for LLM hosting (buyer-relevant, educational)
Under Singapore’s PDPA, organisations that collect, use or disclose personal data must meet the Data Protection Provisions. The PDPC Advisory Guidelines on Key Concepts in the PDPA (PDF) explain core obligations including Protection, Retention Limitation, Transfer Limitation and Accountability. In short for hosting buyers:
- If personal data is in prompts, retrieved context, fine-tune sets or logs, your organisation remains accountable for how that data is handled — including when a vendor processes it on your behalf.
- A data intermediary processes personal data on behalf of and for the purposes of another organisation. Key Concepts guidance stresses clear contractual scope, due diligence, and that the engaging organisation has the same obligations in respect of personal data processed by its intermediary as if it processed the data itself — plus Transfer Limitation when personal data goes overseas.
- The PDPC Advisory Guidelines on Use of Personal Data in AI Recommendation and Decision Systems (issued 1 Mar 2024; PDF) state that third-party developers of bespoke AI Systems (“Service Providers”) are data intermediaries with Protection and Retention Obligations when they handle personal data provided by client organisations. Part V focuses on bespoke / fully customisable AI Systems (not every off-the-shelf SaaS SKU). Still use the same buyer questions: who processes personal data, under whose purposes, with what protection and retention, and where.
PDPC has also published Advisory Guidelines on Use of Personal Data in Generative AI (landing page)—read with counsel for GenAI responsibility allocation. Overview: PDPA overview. Soft rule: if the vendor cannot answer residency, subprocessors, training-on-your-data, staff access and log retention in writing, you still have a demo, not a production hosting decision.
Voluntary GenAI governance cues (IMDA / AI Verify)
Singapore’s Model AI Governance Framework for Generative AI (AI Verify Foundation; released 30 May 2024 per that page) outlines nine dimensions: Accountability; Data; Trusted Development and Deployment; Incident Reporting; Testing and Assurance; Security; Content Provenance; Safety and Alignment R&D; and AI for Public Good. It is voluntary practical guidance—not a hosting certification. For VPC / private LLM RFPs, map questions especially to Accountability, Data, Trusted Development and Deployment, Incident Reporting, Testing and Assurance, and Security alongside PDPA review. Do not invent a pass/fail score.
Original element: deployment-pattern decision matrix
Score each row for the draft RFP or MSA in front of you. Columns are patterns; cells are Accept / Negotiate / Walk guidance — not marketing labels.
| Buyer question / risk | Public multi-tenant API | VPC / private-endpoint hosted | Dedicated or self-hosted private |
|---|---|---|---|
| Compute tenancy | Negotiate: demand written tenancy model (shared GPU vs isolated). Walk: “private” with no tenancy definition. | Accept if dedicated or clearly isolated compute for your tenant is documented. Negotiate shared burst pools. | Accept when hardware/tenant stack is exclusively yours (or named dedicated). Walk if “dedicated” still shares noisy neighbours undocumented. |
| Network isolation | Negotiate: IP allow-lists, mTLS, no public default. Walk: only public internet with shared keys. | Accept private link / VPC endpoint into your cloud. Negotiate break-glass public paths. | Accept when inference stays inside your VPC/on-prem. Walk mandatory vendor WAN for every call without review. |
| Data residency / region binding | Negotiate: pinned region (e.g. ask whether ap-southeast-1 / Southeast Asia is contractually binding — verify with vendor, not assume). Walk: “global routing” with no pin. | Accept if region + AZ binding is contractual. Negotiate DR failover regions in writing. | Accept when data and weights never leave your chosen location without change control. Walk silent cross-region replica. |
| Prompt / response retention by vendor | Negotiate: zero-retention or short TTL; no training use. Walk: indefinite retention “for quality”. | Accept if retention matches your policy and is configurable. Negotiate export/delete SLAs. | Accept when you own the log store and retention job. Negotiate vendor support copies. |
| Admin / support access by vendor staff | Negotiate: named roles, ticketed access, audit logs. Walk: blanket “ops may access content”. | Accept JIT break-glass with customer approval. Negotiate screen-sharing vs data exfil. | Accept customer-held bastion/keys. Walk standing vendor root on production. |
| Training-on-your-data opt-out | Accept only with explicit contractual opt-out (default off preferred). Walk opt-in buried in ToS. | Accept same — enterprise addendum controls. Negotiate eval/red-team data carve-outs. | Accept when fine-tunes stay in your account and never feed vendor base models. Walk automatic upload to vendor training. |
| Egress to third-party tools / plugins | Negotiate: disable tool-calling to unknown hosts; allow-list. Walk: open plugin marketplace on prod data. | Accept egress firewall from the private endpoint. Negotiate each integration. | Accept when your egress proxy owns the allow-list. Walk unmanaged outbound from GPU nodes. |
| Key management / encryption | Negotiate: customer-managed keys if offered; TLS in transit. Walk: vendor-only keys with no rotation story. | Accept CMK/HSM options tied to your KMS. Negotiate key deletion on exit. | Accept keys in your KMS/HSM only. Walk vendor-held unwrap keys for “managed convenience” without review. |
| Subprocessors / support locations | Negotiate: current subprocessor list + notice period. Walk: “may use affiliates worldwide” with no list. | Accept if support regions match Transfer Limitation plan. Negotiate offshore L2/L3 access. | Accept when AMS partners are named and bound. Walk unnamed subcontractors with prompt access. |
| Exit / export of fine-tunes & embeddings | Negotiate: export format + deadline. Walk: fine-tunes trapped in vendor format forever. | Accept documented export of adapters, vector stores, configs. Negotiate wipe certification. | Accept when artefacts already live in your object store. Negotiate vendor-managed components’ offboarding. |
How to fill a cell: underline verbs in the security schedule (retain, access, train, transfer, subprocess). Missing verbs mean Negotiate at best. Keep RAG quality and agent controls separate—use RAG copilots and AI automation once hosting isolation is decided.
Illustrative worked example (not a client case)
A Singapore digital bank / fintech ops team (illustrative, non-client) wants an internal assistant over policy PDFs and masked transaction metadata. Legal wants “Singapore residency.” The first vendor quote is a public multi-tenant API with a Southeast Asia region flag, default prompt logging “for safety,” and training-on-customer-data opt-out only in a self-serve console (not in the MSA).
They apply the matrix. Region flag without contractual pin → Negotiate. Indefinite safety logging → Negotiate until TTL and access roles are written. Console-only training opt-out → Walk for production personal data until the MSA matches. Public internet path → Negotiate allow-lists; for higher sensitivity they shortlist VPC private-endpoint plus customer-managed keys, with a dedicated-inference spike for the hottest corpus.
Outcome (illustrative): pilot stays on non-personal synthetic prompts on the public API; production needs VPC endpoint, contractual region binding, zero-retention or customer-owned logs, explicit no-training clause, named subprocessors, and a fine-tune exit plan—reviewed with counsel against Transfer Limitation if support is offshore.
Buy / not-yet / walk
Buy (commit production personal data) when: tenancy and network isolation are written; residency region is contractually bound (verify the exact cloud region string with the vendor); prompt/response retention matches your policy; training-on-your-data is contractually off by default; vendor staff access is ticketed and auditable; egress and subprocessors are listed; exit/export of fine-tunes and embeddings is tested once.
Not yet when: the demo works but the security schedule is a slide; region is “available” but not pinned; logging retention is “industry standard”; or counsel/DPO has not reviewed Transfer Limitation for offshore support. Pause — use the Singapore software buyers pack to align commercial and security asks, and keep LLM logging/retention as a parallel workstream.
Walk when: the vendor refuses to define tenancy; cannot pin residency; retains prompts indefinitely for model improvement without a hard opt-out; allows standing staff access to content; or traps fine-tunes with no export. Change vendor. A prettier “private” label does not repair missing isolation.
Mistakes that look like “private AI” until they are not
- Treating “deployed in Southeast Asia” as a residency guarantee. Ask whether the region string is contractual, where replicas and backups sit, and which support desks can pull content.
- Confusing private networking with private data use. A VPC endpoint with vendor training-on-your-data still ships value out of your control plane.
- Skipping subprocessor and Transfer Limitation questions because GPUs are “in Singapore.” Offshore L2 support with prompt access is still an overseas access path to review.
- Buying logging you cannot delete. Retention without purpose and access control becomes the next audit finding — design it with the logging Insight, not as an afterthought.
- Starting with agents and plugins before egress allow-lists. Tool-calling to third parties can bypass your carefully chosen hosting pattern.
- Assuming bespoke integrator rules apply unchanged to every SaaS SKU. Use PDPC’s bespoke Service Provider framing where it fits; still demand written answers whenever personal data is touched.
- No exit rehearsal. If you cannot export adapters and wipe vendor copies in a tabletop, you do not yet own the deployment.
FAQs
Does a VPC LLM deployment make us PDPA-compliant?
No. VPC / private-endpoint hosting can improve network isolation and make residency controls easier to evidence, but PDPA obligations (including Protection, Retention, Transfer Limitation and Accountability) still apply to your organisation. Compliance is about purposes, safeguards, contracts and operations — not a single network diagram.
Is a public multi-tenant API always unacceptable for Singapore enterprises?
Not always. For low-sensitivity, non-personal, or carefully redacted workloads with strong contractual controls, it can be a rational pilot or production choice. It becomes a poor fit when personal data, regulated content or model IP requires stronger tenancy, residency binding and access proof.
What should we verify about “ap-southeast-1” or “Southeast Asia” region claims?
Treat them as vendor claims to confirm — which services are pinned, where logs and fine-tunes are stored, DR/backup regions, and whether support tooling can pull content elsewhere. Put the binding in the contract; do not rely on a console default.
How is this different from RAG evaluation or agent governance?
Those decide whether answers are grounded and whether agents act safely. This article decides where inference and related artefacts live and who can touch them. Do both; do not substitute one for the other.
When do we need dedicated or self-hosted instead of VPC-hosted?
When you need exclusive compute, customer-held keys and admin paths you control—and can staff operations (or a bound AMS partner). A well-contracted VPC pattern with strong isolation often beats a neglected “private” cluster.
What to do next
Take the matrix to your shortlist. Score tenancy, network isolation, residency binding, retention, staff access, training opt-out, egress, keys, subprocessors and exit — in writing. If the commercial path is still open, start from private AI Singapore, align landing-zone work with cloud infrastructure Singapore, and contact WC1 when you want a structured private / VPC LLM deployment review before production personal data goes in.