Big AI plans, and a rule that production data stays on-premise
A leading commercial bank in the Gulf region wanted AI across the business. It wanted to transform processes, put AI in its people’s hands and work through a long list of use cases.
The bank runs fully on-premise. Regulation and its own data sovereignty and protection policies keep production data off hyperscale cloud. So the plan was to run AI locally, on its own NVIDIA hardware, for both inference and training.
Scope: the sandbox is a development environment for experimentation. It holds only synthetic or masked data. The bank’s production workloads stay on-premise, and nothing on this page describes production use in the cloud.
Customer name withheld for confidentiality.
Challenge
Before any of that could happen, the bank had to buy GPUs. And it had to buy them without knowing how many it needed.
- A long procurement cycle. Hardware had to be ordered well in advance, with lead times of up to six months. Too little capacity would stall the programme. Too much would leave expensive hardware idle.
- No measured demand. Nobody had run the bank’s use cases yet, so nobody knew how much capacity they would need.
- A team new to the stack. The bank’s data scientists had little hands-on experience with the AI stack, and the bank had no cloud engineering skills in-house.
Any environment in the meantime also had to meet a regulated bank’s bar for security and audit. The ask was clear. Give the bank’s people a real AI environment, fast, without moving production data off-premise. Then turn what they learned into a hardware decision the bank could trust.
Solution
Firemind built an AI Sandbox on AWS. It gave the bank’s teams a secure place to learn the stack, test ideas and validate use cases before anyone committed to hardware.
The data rule came first
The sandbox only ever holds synthetic data generated on the platform, or data masked before upload. Production data stays inside the bank.
A foundation built for a regulated bank
A multi-account landing zone on AWS Control Tower keeps management, the sandbox, security audit and logging in separate accounts. Everything is defined as code in Terraform and deployed through GitHub Actions. Workloads run in private subnets with private connections to AWS services.
Security and audit from day one
People sign in with their existing bank accounts through Microsoft Entra ID, and each role gets only the permissions it needs. Data is encrypted with customer-managed keys, and storage only accepts encrypted connections. GuardDuty and Security Hub, checking against the CIS AWS Foundations Benchmark, run from a dedicated security audit account. CloudTrail records every read and write to storage and databases, plus all management activity, and keeps the logs in a separate archive account. Near the end of delivery, Firemind ran a security audit of the sandbox, fixed its findings, and gave the bank’s security team its own access for auditing.
The same tools the bank will use on-premise
NVIDIA AI Enterprise runs as custom containers on Amazon SageMaker. Each team or project gets its own GPU-backed environment on demand. Because NVIDIA AI Enterprise also runs on-premise, what the bank’s people learn and build carries across.
Guardrails on GPU spend
Idle notebooks and Studio apps shut down automatically after 60 minutes. Only approved instance types can be launched. Every account has a monthly budget, daily alerts flag unusual spend, and costs are tracked per user.
Hands-on enablement
Training started in the first week of delivery. Firemind took the bank’s data science team from GenAI concepts to hands-on LLM deployment, NVIDIA NIM and NeMo, then ran architecture workshops and code reviews as the team built its first use case.
Support while the teams explored
After the build, the sandbox moved into Firemind’s Managed AI service. Firemind handled the bank’s requests to provision instances, schedule them to keep costs down, and sort out permissions in the landing zone. It also worked with the bank’s teams on understanding the models and designing AI architectures and agents.
At the end, Firemind helped size the NVIDIA infrastructure and GPU configuration the bank needed. The bank bought the hardware through its own provider.
Results
Beyond the figures above:
- Use cases validated, not assumed. The bank’s teams explored the stack and validated their use cases with proofs of concept. They picked one, built it with Firemind’s guidance and demonstrated it to stakeholders.
- Capacity sized from experience. From what they learned, the bank set its final on-premise capacity requirements and bought NVIDIA hardware with a business case it had already tested.
- A team that knows the tools. The bank’s people already know the stack they will use on-premise.
They knew that this is the hardware, this is the business case, because they already were able to test it.
When hardware takes months to arrive, a wrong guess is expensive. A governed cloud sandbox lets you prove the use cases first, then buy the capacity you know you need.
