Then the cloud happened, and the pitch was compelling: get rid of the box, stop worrying about hardware failures, access your stuff from anywhere. For most businesses, it was the right call. We moved hundreds of clients onto cloud platforms over the years, and the vast majority of them ended up in a better spot.

But something interesting is happening now. The same technology wave that made the cloud feel inevitable (AI, specifically) is creating reasons for some of that infrastructure to come back in-house. Not all of it. Not for everyone. But the pendulum is swinging, and it’s worth understanding why.

The cloud era made real sense

Let’s be clear about why businesses moved to the cloud in the first place, because those reasons haven’t disappeared.

Cloud platforms like Microsoft 365, Google Workspace, and AWS gave small businesses access to infrastructure that used to require a full-time IT person and a room full of equipment. Email, file storage, collaboration tools, backups. All of it handled by someone else’s data centre, updated automatically, accessible from a laptop at home or a phone on a job site.

For a 15-person office in Surrey, that was genuinely transformative. No more worrying about whether the backup ran last night. No more drive failures taking down the whole office for a day. The cloud solved real problems, and for most everyday business tasks, it still does.

So why is anything coming back?

Two things changed: AI got useful enough that businesses actually want to run it, and people started paying closer attention to where their data goes when they do.

When you use a cloud AI tool (ChatGPT, Copilot, Gemini, whatever your team has started playing with), your prompts, your documents, and your questions are typically being processed on someone else’s servers. For a lot of use cases, that’s fine. Asking an AI to help draft a marketing email isn’t a data sensitivity issue. (If you’re weighing those tools against each other, we compared the privacy implications of ChatGPT and Copilot here.)

But the moment you start feeding it client contracts, financial records, employee files, or proprietary business processes, the picture changes. That data is leaving your environment. It’s being processed on infrastructure you don’t control, in a jurisdiction you may not have thought about, under terms of service that can change without much notice.

This is where the on-premise conversation is coming back, and it looks nothing like the old server-in-the-closet days.

What “on-premise AI” actually looks like in 2026

When we say on-premise now, we’re not talking about going back to a noisy rack in the back room. The hardware has gotten remarkably small and quiet.

A Mac Mini sitting on a shelf can now run a capable AI model locally. Open-source language models (think of them as private versions of ChatGPT that run entirely on your own hardware) have gotten good enough that for many business tasks, they’re genuinely useful. Your team can ask questions, summarize documents, draft communications, and analyze data, all without anything leaving your office network. We wrote a deeper dive on what one of these setups actually looks like in practice.

The setup runs quietly, costs a few dollars a month in electricity, and once it’s configured, your team interacts with it the same way they’d use any other AI tool. The difference is that the data stays on your hardware, in your office, under your control.

We’ve been setting these up for clients who have specific data sensitivity requirements, and the reaction is usually the same: “Wait, this runs here? On that little thing?”

The data sovereignty angle (especially in Canada)

This matters more for Canadian businesses than a lot of people realize.

American companies control roughly 60% of Canada’s cloud market. AWS, Microsoft Azure, and Google Cloud dominate. Even when your data is stored in a Canadian data centre, if the provider is headquartered in the US, it may still be subject to American laws like the CLOUD Act, which can compel disclosure of data stored abroad.

Canada’s privacy framework is also shifting. PIPEDA, the federal privacy law, was written before cloud computing was a thing most people had heard of. New federal privacy legislation is expected soon, potentially with fines up to $25 million or 5% of global revenue. And here in BC, we have PIPA, our own provincial privacy law that’s stricter than what most other provinces require, particularly relevant for healthcare, legal, and financial services businesses.

For a law firm in Langley handling sensitive client files, or a medical clinic in Surrey processing patient records, where your AI processes data isn’t an abstract question. It’s a compliance question with real consequences.

This isn’t about abandoning the cloud

The important thing to understand is that this isn’t an either/or situation. Almost nobody is ripping out their cloud infrastructure entirely, and that wouldn’t make sense for most businesses.

What’s happening instead is a hybrid approach. Your email, your collaboration tools, your everyday file storage: those stay in the cloud, where they work well. But for AI workloads that touch sensitive data, for processes where you need to know exactly where information lives and who can access it, some of that is moving back onto local hardware.

Industry analysts are seeing this play out broadly. A recent Barclays CIO Survey found that 86% of chief information officers planned to move at least some cloud workloads back to on-premise or private cloud, the highest number on record. Gartner is projecting that 40% of enterprises will adopt hybrid compute architectures for critical work, up from around 8% previously. And organizations that have made strategic moves back are reporting 30% to 60% reductions in infrastructure costs for those specific workloads.

These are enterprise numbers, but the pattern filters down. When the tools get simpler and the hardware gets cheaper (and both are happening fast), small businesses start making the same calculations.

What this means if you run a small business

You don’t need to become a technology expert to navigate this. But there are a few things worth thinking about:

• Know where your data goes when you use AI tools. If your team is using ChatGPT or similar tools with client data, understand that information is being processed externally. That may be fine for some tasks and not fine for others.
• Understand your industry’s requirements. If you’re in healthcare, legal, financial services, or any field that handles personal information in BC, your obligations under PIPEDA and PIPA are real. AI doesn’t get an exemption from privacy law.
• Ask about local options. Private AI running on local hardware is no longer a big-company-only solution. The cost has dropped to the point where it’s realistic for a business with 10 or 15 people.
• Think hybrid, not binary. The goal isn’t to pick a side. It’s to put the right workloads in the right place. Cloud for what makes sense in the cloud. Local for what needs to stay local.

The pendulum keeps moving

Technology tends to swing back and forth like this. Mainframes gave way to personal computers. Personal computers gave way to cloud. And now cloud is giving way to something more nuanced: a mix of cloud and local that depends on what you’re actually doing with the data.

The businesses that handle this transition well won’t be the ones who pick one approach and stick with it out of habit. They’ll be the ones who actually understand what they’re working with and make deliberate choices about where things run and why.

We’ve been helping Lower Mainland businesses navigate these kinds of infrastructure decisions since 2006, from the server closet era through the cloud migration and now into this hybrid AI world. If you’re starting to think about where AI fits into your business and want to understand your options (cloud, local, or some combination), we’re happy to walk through it with you. Book a free consultation with Raxxos and we’ll take a look at what makes sense for your setup.

The post Your Business Moved to the Cloud. AI Might Be the Reason Some of It Comes Back. appeared first on Raxxos Technology Inc..

It’s called Google NotebookLM. And while it’s gotten some attention in tech circles, most small and mid-sized businesses in the Lower Mainland and across BC still haven’t come across it. That gap is worth closing, but with some important caveats for Canadian businesses, especially those of you who’ve made a deliberate choice to keep your data inside Microsoft 365.

What NotebookLM actually does

NotebookLM lets you upload documents (PDFs, Google Docs, meeting transcripts, web pages, audio files) and then have a conversation with them. You ask questions, it answers from the material you’ve provided. It summarizes, cross-references, pulls specific clauses, surfaces key points.

What makes it different from just pasting something into ChatGPT is that it’s grounded entirely in what you’ve uploaded. When it gives you an answer, it cites the specific source and page. You can click through and verify. It’s not mixing in outside information or making things up from its training data. It’s working from your documents and only your documents.

That grounding is the whole reason it works for business use. “Does our service agreement include a limitation of liability clause?” gets you a real answer tied to the actual text, not a generic explanation of what limitation of liability clauses usually say.

What businesses are using it for

The use cases tend to cluster around a few areas:

• Contract and document review. Upload a vendor agreement, lease, or service contract. Ask it to summarize key terms, flag unusual clauses, or explain a section in plain English. Not a replacement for a lawyer on anything consequential, but useful for getting oriented before you spend lawyer time on it.
• Meeting notes and project follow-up. Upload transcripts or notes from a series of client meetings. Ask it to pull all open action items, summarize what was decided on a topic, or identify themes across the last six months of conversations.
• Staff onboarding and training. Upload your operations manual, policies, or technical documentation. New employees can ask questions and get answers from your actual materials, rather than interrupting someone senior for every small thing.
• Research and competitive analysis. Upload industry reports, competitor materials, or market analyses and ask it to compare, summarize, or extract specific data points.

There’s also a feature called Audio Overview that surprises most people the first time they try it. NotebookLM can generate a podcast-style audio conversation between two AI hosts discussing the contents of your notebook. Upload a dense report, click one button, and a few minutes later you have a natural-sounding audio summary you can listen to on your commute. It’s more useful than it sounds.

The question Canadian businesses should ask first

Before you start uploading client files and internal documents to any AI tool, there’s a question worth asking: where does your data go, and what happens to it?

For Canadian businesses, this has real implications under PIPEDA (Canada’s federal private sector privacy law) and under provincial equivalents in BC, Alberta, and Quebec. If you’re uploading documents that contain client personal information, you have obligations around how that information is handled and where it’s processed.

The good news on NotebookLM: Google has stated that your uploaded documents are never used to train its AI models. If you’re accessing it through a Google Workspace account (a paid work account, not a personal Gmail), your uploads and queries are shielded from human review entirely. That’s a meaningful distinction from using a personal account.

The less good news: your data is processed on Google’s servers, which for some regulated industries or clients with strict data handling requirements may not be appropriate. If you’re handling health information, legal files, or anything covered by a client confidentiality agreement, read the terms carefully before uploading.

Which brings us to the bigger question we get from a lot of the businesses we work with.

We’re a Microsoft shop. Is there a NotebookLM for us?

This is one of the principles we follow with the businesses we advise at Raxxos: pick one vendor ecosystem and stay in it. For most BC businesses, that means either Google Workspace or Microsoft 365. And for the majority of our clients, it’s Microsoft.

The argument for staying in your ecosystem isn’t just about simplicity. It’s about security and data governance. Every time you introduce a third-party AI tool that sits outside your primary vendor’s environment, you’re creating a new surface area for data to leave that environment. That’s a manageable risk in some contexts. In others, it’s not worth it.

So if you’re a Microsoft 365 shop and you want what NotebookLM offers, the answer is Microsoft Copilot Notebooks.

Copilot Notebooks is Microsoft’s direct equivalent. It’s an AI-powered workspace where you bring together files, meeting notes, chat history from Teams, links, and other content, and then use Copilot to query, summarize, and work with all of it. Because it lives inside Microsoft 365, your data stays inside your existing Microsoft tenant. The same data governance policies, the same compliance boundaries, the same security controls you’ve already set up apply automatically.

The tradeoff is cost. NotebookLM is free. Copilot Notebooks requires a Microsoft 365 Copilot license, which runs around $30 USD per user per month on top of your existing Microsoft 365 subscription. For a team of ten, that’s a real number to weigh.

But for businesses that have made Microsoft their platform and want to keep all their data there (which is the right call for most businesses from a security and simplicity standpoint) Copilot Notebooks is the better choice. You’re not introducing a new vendor, a new set of terms, or a new place for data to land.

Our own team uses it for exactly this kind of work. Georgy Johnson, one of our technicians, recently used Copilot to set up a structured Microsoft OneNote runbook for IT operations, something that would have taken hours to research and design manually. “It gave me a great template to follow,” he notes. That’s the kind of practical, in-workflow use case that makes Copilot worth the investment for a Microsoft-first business.

“The common concern I hear regarding AI tool use is data security, whether what you share is ever used externally. I tell our clients, who are all on Microsoft, to stick to using Copilot instead of other tools, as your data stays within the organization. Of course you need to put some guardrails in place, but overall Microsoft and Copilot have been great for troubleshooting, writing scripts, and assisting with other tasks.”

Georgy Johnson, Raxxos Technology Inc.

How to think about this decision

Here’s a simple framework:

• You’re on Google Workspace and handle relatively low-sensitivity documents: NotebookLM is free, works well, and is worth trying today. Start with notebooklm.google.com.
• You’re on Google Workspace and handle sensitive client data: Use NotebookLM through your Workspace account (not personal Gmail), review Google’s data handling terms, and consider whether specific document types should stay out of it entirely.
• You’re on Microsoft 365 and want to keep everything in your ecosystem: Look at Microsoft Copilot Notebooks. Factor the licensing cost into your decision, but take seriously the security benefit of staying inside a single vendor environment.
• You’re not sure what ecosystem you’re in or whether your current setup is actually secure: That’s a conversation worth having before you add any AI tools to the mix.

The broader point is that AI tools for document work are genuinely useful and not particularly complicated to start using. The question isn’t whether they’re worth trying. It’s whether you’re trying them in a way that’s appropriate for the kind of data your business handles.

If you want a straight answer on what makes sense for your specific setup, what tools are appropriate, what the actual security and privacy implications are, and how to introduce AI capabilities without creating new problems, that’s exactly the kind of conversation we have with businesses across the Lower Mainland every day. Book a free call with Raxxos and we’ll give you a straight answer.

The post Google NotebookLM: Should Your BC Business Use It? (And What Microsoft 365 Users Should Know) appeared first on Raxxos Technology Inc..

Important Notice from Raxxos

We do not recommend the use of OpenClaw for most businesses. While it is an impressive and capable piece of technology, OpenClaw is a complex, high-risk software platform that should not be operated without extensive cybersecurity experience and careful planning. There are documented cases of OpenClaw instances being compromised due to misconfiguration and security vulnerabilities. If you choose to deploy it, you do so at your own risk. We strongly encourage consulting with a qualified IT security professional before proceeding.

OpenClaw has attracted significant attention in tech circles — 60,000 GitHub stars in 72 hours, comparisons to JARVIS, and a wave of developers ordering Mac Minis specifically to run it. Most of the coverage has been aimed at developers and early adopters. This article is aimed at business owners who want to understand what it actually is, how it works, and — critically — why Raxxos advises most businesses to approach it with caution.

Georgy Johnson, a technician here at Raxxos, says that as of right now he hasn’t had clients come to him directly with questions about OpenClaw — but he’s noticed how fast it’s moving through conversations. “News about it is spreading like wildfire,” he told us. “It’s the hottest topic right now.” That tracks with what we’ve seen: the buzz is real, the questions are coming, and most of the information out there isn’t aimed at helping business owners make a clear-headed decision.

The Hype Machine Nobody Is Talking About

If you’ve been on YouTube recently, you’ve seen the videos. “Everyone should be using OpenClaw.” “Here’s how easy it is to set up.” “I built an AI employee in 20 minutes.” The thumbnails are bold, the energy is high, and the message is consistent: this is the future and you’re already behind.

What most of those videos don’t tell you is who’s paying for them.

A significant number of the most-watched OpenClaw tutorials are sponsored by VPS hosting companies — Hostinger being the most prominent example. The business model is straightforward: get as many people as possible to sign up for a VPS through an affiliate link, earn a commission on each signup. The more people who run OpenClaw, the more VPS subscriptions get sold. The incentive is volume, not accuracy.

One well-known AI YouTuber has publicly stated he was offered $30,000 to promote Hostinger on his channel — and turned it down specifically because he didn’t feel comfortable with the promotional angle. That’s a meaningful data point. For every creator who turned it down, plenty accepted.

The result is a YouTube landscape where the vast majority of OpenClaw content is financially incentivized to make the setup look easy, the risks look manageable, and the audience feel like they’re missing out if they don’t act now. Almost none of it addresses the real security questions in any depth.

We’re not saying OpenClaw is a scam or that everyone covering it is acting in bad faith. We’re saying the information environment around it is heavily distorted by financial incentives, and business owners making decisions based on that content are working with an incomplete picture.

One More Thing Worth Knowing: It Was Vibe-Coded

OpenClaw is open-source software, which means anyone can read the code. People who have done so have noted that significant portions of it appear to have been written with heavy AI assistance — what the developer community has started calling “vibe-coded” software. Code generated quickly with AI tools, iterated fast, shipped fast.

That’s not inherently a disqualifier. A lot of software is built this way now and works fine. But vibe-coded software that is being deployed with broad access to your business systems, your email, your files, and your network — and that has not been through the kind of rigorous security audit that enterprise software typically undergoes — is a different category of risk. The people qualified to evaluate whether a piece of software like this is safe to run in a business environment are cybersecurity professionals who can read the code, understand the architecture, and assess whether it’s been sandboxed correctly. That is not most business owners, and it is not most YouTube tutorial watchers.

What OpenClaw Actually Is

OpenClaw is an open-source AI agent that you install on your own hardware. Unlike ChatGPT or Microsoft Copilot, which are cloud services you log into through a browser, OpenClaw runs locally — on a computer in your office, on your home network, or on a private server you control.

Once it’s running, it acts as an always-on AI coordinator. It connects to the apps and data you already use, takes instructions through messaging apps, executes tasks autonomously, and builds up a memory of your preferences and context over time.

The key distinction from most other AI tools is that OpenClaw doesn’t just answer questions — it takes actions. It can read and write files, send messages, search the web, run scripts, draft and send emails, monitor things on a schedule, and coordinate tasks in the background without you manually prompting it each time.

One important note: OpenClaw is the agent layer, not the AI itself. It connects to AI models separately — either cloud-based ones like Claude or GPT-4, or models running locally on your own hardware. That distinction matters a lot when it comes to privacy and security.

How People Interact With It

You don’t interact with OpenClaw through a dedicated app or dashboard. You talk to it through messaging apps you’re already using — WhatsApp, Telegram, iMessage, Slack, Discord. You send a message the way you’d send one to a colleague, and OpenClaw responds and acts on it.

That interface simplicity is part of what makes it appealing. It’s also part of what makes it dangerous — because the ease of use can obscure how much access the agent actually has to your systems.

What Some Businesses Are Using It For

The OpenClaw community has shared a range of real-world use cases — inbox management, daily briefings, document drafting, research tasks, lead monitoring, and meeting prep. In the right hands, with the right configuration, some of these applications are genuinely useful.

We’re not going to walk through each one in detail here, because we don’t want to get ahead of the more important conversation: whether any business should be running OpenClaw at all without proper security infrastructure in place.

Why Raxxos Advises Most Businesses to Stay Away — For Now

We work with businesses across the Lower Mainland on IT and cybersecurity every day. When we look at OpenClaw through that lens, we see a tool with real capability and real risk — and the risk profile is serious enough that we want to be direct about it.

Georgy described the pattern he sees when businesses move quickly on new technology without thinking through the downstream effects: “A common oversight is failing to consider the broader implications. While the intended outcome may be highly beneficial, the process can introduce unforeseen security, compliance, or reputational risks. In some cases, those challenges only become apparent after significant progress has been made — which makes them much harder to address.” That’s a good description of what we’ve seen with OpenClaw deployments that went wrong.

There are documented cases of OpenClaw instances being compromised. Because OpenClaw is open-source and self-hosted, the security of any given deployment depends entirely on how it’s configured and maintained. Misconfigured instances have been exploited. This isn’t theoretical — it’s happened to real deployments run by people who thought they had it set up correctly.

An agent with broad access is a significant attack surface. OpenClaw is designed to have access to a lot — your files, email, calendar, browser, and the ability to run scripts and execute commands on your systems. That access is where its usefulness comes from. It’s also where a security failure becomes catastrophic. A compromised or misconfigured agent could expose sensitive client data, send communications you didn’t authorize, or make system changes that are difficult or impossible to reverse.

Prompt injection is a real and underappreciated threat. Because OpenClaw acts on instructions it receives and processes content from the web, email, and documents, malicious content in those sources can potentially be crafted to hijack the agent’s behaviour. This attack vector is active and not fully solved in any current AI agent framework, including OpenClaw.

Most setups transmit data to US servers. OpenClaw runs locally, but the AI models it connects to usually don’t. If you’re using cloud-based models like GPT-4 or Claude — which most people do — the content of your tasks, conversations, and file contents is transmitted to servers in the United States. For businesses handling sensitive client data under PIPEDA or BC’s PIPA, this is a compliance issue that needs a clear answer before deployment, not after.

Nobody is monitoring it by default. Like any software running on your infrastructure, OpenClaw needs to be kept updated, monitored, and troubleshot. Logs should be reviewed. Permissions should be audited. If something behaves unexpectedly, someone needs to notice and respond. Most small businesses don’t have the internal IT capacity to manage that ongoing vigilance — and without it, problems tend to compound quietly until they become serious.

There is no vendor accountability. OpenClaw is open-source software maintained by a community. There is no company standing behind it with a support line, an SLA, or liability if something goes wrong. You are on your own in a way that is fundamentally different from using an enterprise software product.

Who Should Be Running OpenClaw

Developers, security professionals, and technically sophisticated early adopters who understand what they’re taking on and have the skills to configure it safely. Specifically: people who can read and audit the source code, understand how to properly sandbox an application with broad system access, and have the expertise to evaluate whether a rapidly-developed, AI-assisted codebase meets the security standards required for their environment.

That is a small group. It does not describe most business owners, and it does not describe most people watching YouTube tutorials about how to set this up in an afternoon.

The way Georgy thinks about new technology decisions reflects how we approach this with clients generally: “My mindset is that you only need just enough tech to get the job done — nothing less, nothing more.” OpenClaw may well be the right tool for certain businesses eventually, as the ecosystem matures and security tooling improves around it. Right now, for most businesses, it’s more tech than the job requires — and more risk than the benefit justifies.

If that’s not you or someone on your team, we’d encourage waiting. The AI agent space is moving fast. Tools that deliver similar capabilities with better security guardrails, vendor accountability, and easier configuration are coming — and some already exist within platforms like Microsoft 365 Copilot that are built with enterprise security from the ground up.

If You’re Still Interested

We’re not here to tell you what to do. If you’re curious about OpenClaw and want to understand whether there’s a version of this that could work securely for your business, we’re happy to have that conversation. We can help you evaluate whether the use case makes sense, what a responsible deployment would actually require, and whether the risk-benefit calculation adds up for your situation.

What we won’t do is set it up for a client without that conversation happening first. The exposure is too significant for us to treat it as a routine implementation.

Book a free conversation with Raxxos if you want a straight answer on whether this is right for your business — and if not, what alternatives might get you where you want to go.

The post What Is OpenClaw and What Does It Actually Look Like When a Business Uses It? appeared first on Raxxos Technology Inc..