Claude cannot run on OpenMetal, because it is closed-weight and there is no model to install: Opus 5 and every other Claude model run on Anthropic’s cloud, reached over the API. What you can self-host on OpenMetal is the entire stack around it, the chat interface, the agent’s tool execution, your retrieval corpus, your logs, and the proxy that governs every outbound call. That puts you at the data-plane tier of the sovereignty spectrum: your application and data stay inside a single-tenant boundary you control, while the one unavoidable movement, the prompt crossing to Anthropic, happens on your terms through a control point you own.
Key Takeaways
- You self-host the Claude stack, not Claude. The model runs on Anthropic’s cloud. The UI, agent sandbox, retrieval layer, logs, and egress proxy run on your single-tenant OpenMetal environment.
- Anthropic’s self-hosted sandbox moves tool execution to you, not the model. In its 2026 public beta, tool execution and private-network access run inside your perimeter while orchestration stays on Anthropic. The model call is still an API call.
- The egress proxy is where you enforce what leaves. Sitting on your hardware at the single north-bound exit, it redacts, tokenizes, and logs every prompt before it reaches the API.
- The residual is real: prompts still leave. Anthropic’s default no-training terms, 7-day log retention, and optional zero data retention govern how that data is handled, but they do not keep it on your network.
- A Claude BAA is narrower than it looks, and separate from OpenMetal’s HIPAA. It covers the first-party API and Enterprise, is scoped to one organization, and excludes several surfaces. Read the honest ceiling before you design for regulated data.
1. What runs where
Claude is closed-weight. Opus 5 runs on Anthropic’s infrastructure, or on a cloud partner Anthropic serves it through, and never on a machine you control. That fact fixes exactly one row of the stack on the provider’s side. Everything else can be yours.
| Layer | Where it runs | Note |
|---|---|---|
| Chat UI, session, auth | Your OpenMetal environment | Open-source front-end keeps chat history and prompts on your servers |
| Agent orchestration loop | Your OpenMetal environment | Your own harness or the SDK; a fully Anthropic-managed agent loop would stay provider-side |
| Tool execution / code sandbox | Your OpenMetal environment | Anthropic’s self-hosted sandbox runs bash, file ops, and code in a container you control |
| Retrieval corpus + vector database | Your OpenMetal environment | Your proprietary corpus never uploads; only the snippets you inject into a prompt go out |
| Embeddings | Either | An open-weight embedding model runs locally; Anthropic-side embeddings would be an API call |
| Prompt and completion logs | Your OpenMetal environment | Your audit trail, not a vendor dashboard |
| Guardrail / DLP / egress proxy | Your OpenMetal environment | The control point: enforces what leaves |
| Model inference (Opus 5) | Anthropic’s cloud | Always. This is the closed part |
| The wire (prompt out, completion back) | In transit | TLS; governed by Anthropic’s retention and no-training terms |
The only data that must leave is the prompt and its completion. Your egress proxy decides what each prompt actually carries.
2. Deployment options for Claude
Anthropic offers four routes for keeping more of the system inside your boundary. None of them puts the model on your hardware.
- API direct. Your application on OpenMetal calls the Claude API with your key. By default Anthropic does not train on data sent under the commercial terms, and API log retention is 7 days (reduced from 30 in September 2025). This is the baseline every other route builds on.
- Self-hosted sandbox. The headline option for agents. In its 2026 public beta, Anthropic runs the model and the agent loop, while tool execution runs in a container you control, either your own OpenMetal environment or a supported provider. Code, files, and internal systems the agent touches stay inside your perimeter, and the execution layer becomes eligible for zero data retention and HIPAA BAA handling. MCP tunnels, which let the hosted agent reach tools on your private network, are in research preview.
[VERIFY]exact eligibility and beta status at build time. - Cloud-partner route. Claude is the only frontier model available on all three major clouds: Amazon Bedrock, Google Vertex AI, and Microsoft Foundry. If you already hold a data agreement with one of them, serving Claude through that endpoint can change which entity processes the data and where the region sits, without changing the fact that the model is not on your metal.
- Self-hosted UI. An open-source chat front-end on your OpenMetal servers, connected to the API. Your users, prompt templates, and conversation history live in your database.
3. What you host on OpenMetal
Every layer you own here is ordinary compute. It does not need a GPU, and it benefits from single-tenant hardware, a private network, and predictable cost.
On a Hosted Private Cloud or Bare Metal deployment, the chat UI, the agent sandbox, the retrieval corpus and its vector database, your logs, and the egress proxy all run on hardware only you use. Traffic between them is east-west private-network traffic on per-customer private networks, included rather than metered, so your retrieval and logging layers can be as busy as they need to be without a transfer bill. Public egress ships with a generous included allotment, which is all the Claude calls need.
The guardrail and egress-proxy tier is the part to design deliberately. Sitting at the single north-bound egress point on hardware you control, it inspects every outbound prompt: redacting or tokenizing fields, applying policy on what may be sent to Anthropic, and recording exactly what crossed. Because it is your infrastructure rather than a provider setting, the rule for what leaves is yours to write and yours to audit.
4. The honest ceiling
State the limits plainly, because they are what make the rest trustworthy.
- Claude never runs locally. Opus 5 is closed-weight. There is nothing to download and nothing to load on an OpenMetal GPU. Anyone who tells you a flagship Claude model can be served from your own hardware is mistaken.
- Prompts and completions still transit to Anthropic. Default no-training terms, 7-day log retention, and an optional zero-data-retention agreement govern how Anthropic handles that data, but they do not keep it inside your network. Sovereignty here is boundary control, not zero egress.
- A Claude BAA is real, but narrow, and separate from OpenMetal’s HIPAA. Anthropic will sign a BAA covering HIPAA-ready first-party services such as the Messages API and Enterprise plans, but it is scoped to the single organization that accepts it and excludes surfaces like the Console, Workbench, Cowork, and beta features. Note also that covered models require 30-day retention and are therefore not available with zero data retention enabled, so you choose one arrangement or the other. None of this is provided by OpenMetal’s organization-level HIPAA posture, which covers your infrastructure, not the API call. The two are additive and both are required for regulated data.
[VERIFY]the current BAA scope and eligible services against Anthropic’s terms before you rely on them. - Air-gapped or classified workloads exclude Claude entirely. If nothing may leave the network, no Claude route qualifies. Route those workloads to an open-weight model on your own OpenMetal GPUs instead.
5. When local GPUs enter (hybrid)
The data-plane tier and the full-sovereignty tier are not mutually exclusive. A hybrid design routes the bulk of traffic, and anything too sensitive to send out, to an open-weight model running on your own OpenMetal GPU servers, behind the same egress proxy, and escalates only the hardest prompts to Claude’s API. That shrinks what leaves your boundary and trims token spend at the same time. The open-weight side of that design is our Model Deployment Fit series, where models like Llama and gpt-oss run on OpenMetal H200 and NVIDIA RTX PRO 6000 servers, each of which uses discrete GPUs rather than a pooled accelerator.
6. Running your Claude stack on OpenMetal
The reason to run this stack on OpenMetal rather than a hyperscaler is that the data-plane tier is only worth it if the boundary is real. Single-tenancy means your vector store and your logs sit on hardware no other tenant shares. Per-customer private networking means the traffic between your app, your retrieval layer, and your proxy never touches the public internet. Included egress and fixed monthly pricing mean the architecture does not penalize you for keeping data close.
There is a strategic payoff as well. Because Claude sits behind your own proxy, your data plane is provider-neutral: you can point it at Claude today, add another provider tomorrow, or fail over between them, without moving your corpus, your logs, or your guardrails. You own the substrate, and the model is a swappable backend. That is the opposite of building your whole stack inside one vendor’s managed platform.
Design your private Claude deployment
The right shape depends on your data-handling requirements, which Claude route fits them, and how much of your workload could run on an open-weight model you host yourself. Bring your stack and your constraints, and OpenMetal can help you map what stays inside your boundary, size the environment, and stand up a proof of concept for testing against your own workloads.
Talk to an OpenMetal architect