The agent runs on an isolated appliance. Raw audio never leaves it. You choose whether transcripts go to a cloud model or to inference you run inside your own boundary.
Where the agent is contained, where the data is allowed to sit, and what the whole thing costs to run.
You already put untrusted workloads in a DMZ. Give the agent the same treatment: run it under a NemoClaw sandbox, which egress-locks it by default and reaches your environment through one inference API you can scope, log, rate-limit, and revoke. Plain OpenClaw does not get this automatically. Teaport works with either.
Raw room audio never leaves the appliance. Run the LLM on-prem and no conversation data crosses your boundary, audio or text.
On-device speech kills two metered vendors, the per-minute STT bill and the per-character TTS bill, and folds them into fixed per-seat capex. Voice is bursty, so one pooled, stateless LLM serves many seats.
Two things usually bring an organization to on-device voice: audio that is not allowed to leave the premises, and work that has to carry on when the connection does not. A third is arithmetic, once the per-minute bills are annualized.
Clinic
Dictation at the point of care, or an intake that runs in the room with the patient. Raw audio stays on the appliance, and with inference on-prem the transcript never crosses your boundary either.
Classroom
A reading tutor, a language partner, an assistive listener at the desk. Student speech is the one thing you cannot hand to a vendor for processing, and here it never gets that far.
Contact center
Voice is bursty. Every seat needs an ear and a mouth, but only a fraction of them are mid-sentence at once, so the ears and mouths become fixed per-seat hardware and one pooled model serves the room.
Field site
A depot, a vehicle, a substation, somewhere the signal was never good and sometimes never there. Speech to text and speech synthesis always run on the board, so with the model on the LAN the loop closes with no link at all.
Speech to text and text to speech always run on the appliance, so your raw audio never leaves it. Where the text goes next depends on where you point the LLM.
audio + agent + memory live here
only the LLM call leaves the box
With a cloud provider, only the text of what you say reaches them. Pick one with zero data retention. Run your models on your own hardware, turn off web tools, and nothing leaves your network at all, voice or text. Cloud-first assistants can’t offer that. Your data is their business.
Nothing on this page is a certification, and no architecture stops every attack. So here it is in three parts: what the appliance keeps, what a sandbox adds, and what none of it covers.
Speech to text and text to speech run on the appliance. Microphone audio is never transmitted, to us or to anyone else.
The agent’s identity files and everything it remembers sit on the appliance’s own disk. Nothing syncs them anywhere.
Teaport talks to the brain over an authenticated local link, not an open port anything on the network can reach.
Point the LLM at inference inside your boundary and the text stays too. Point it at a frontier API and it leaves. That is a one-variable decision, and it is yours.
Plain OpenClaw does not get these on its own. Run the agent under a NemoClaw sandbox and it does. Teaport works either way; for containment worth the name, use the sandbox.
The agent gets no outbound network by default. It reaches your environment through one inference API instead of the open internet.
That single API is something you can scope, log, rate-limit and put a policy in front of. An agent with general web access is not.
Pull the key and the appliance goes quiet. It still hears and speaks locally; it stops thinking.
An agent with shell, file and web access can be talked into misusing all three by something it reads. The sandbox limits the blast radius. It does not stop the agent from being convinced.
Identity files, memory and model weights are on a small board’s disk. Treat it like any other unattended endpoint: encryption, a locked cabinet, an asset tag.
Point it at a cloud API and transcripts reach that provider under that provider’s terms. Teaport decides what leaves the board, not what happens afterwards.
On-device speech does not decide who is allowed to be in earshot. That is a room policy question, not an architectural one.
This is architecture that supports HIPAA, FERPA and sovereignty work. We can give your security review the deployment detail it needs to reach its own conclusion.
On your hardware, in the room the work actually happens in. All it needs from you is a board, a network segment it can sit on, an inference endpoint you can name, and one person who will use it daily.
Tell us the room, what the audio is, and where inference is allowed to run. We tell you whether this fits. If it does not fit, we say so on that call rather than three weeks later.
You provide An inference endpoint you can name, cloud or on-prem.
A Jetson Orin Nano 8 GB, about $400 at today’s price. One command puts the engine and models on it and points it at whichever inference endpoint you nominate.
You provide The board, or the budget for one, and a network segment it can sit on.
Not a demo bench. The clinic, the classroom, the depot, with the people who would actually use it, for long enough that the awkward days are in the sample.
You provide Someone in the room who will use it daily.
What worked, what the latency actually was in that room, and what a rollout to your seat count would need from your network.
Running one of these, or something close enough to it? Tell us what the room looks like, what the audio is, and where inference is allowed to run, and we will tell you whether this fits and what a pilot on your own hardware would involve.
Or write to us directly at stefano@teaspoon.tech.
Organizations need a written license. That is part of what we work out in a pilot, not a hurdle before it.
License
The engine is free for personal use by individuals under the Teaport Engine License 1.0. Organizations, and any commercial use of the engine, need a separate written license. The brain, built on Pipecat, ships under plain MIT. To license the engine, write to stefano@teaspoon.tech.