# User Problem

* **OpenProject (MVP phase):** We need LLM infrastructure to build and test AI-powered features with production data. First priority is figuring out what model to use and how many users a single server can handle.

* **OpenProject (production readiness):** The infrastructure must be production-grade for our SaaS and on-premise deployments, this includes scalability as Begin of the deletion asEnd of the deletion demand grows.

* **On-premise administrators:** Need to deploy and maintain AI capabilities within their own infrastructure and compliance boundaries.

* **Regulated-industry customers:** Operate under strict DSGVO and sector-specific regulation. Any AI that routes data externally is a non-starter.

* **Organizations with own AI infrastructure:** Have access to their own AI data centers and should be able to bring and run their own models with OpenProject.


## Problem

* Users and organizations want AI features in OpenProject, but they would need to send data to third-party LLM providers. For customers handling sensitive project data, this is unacceptable.

* Self-hosted LLM are either underperforming and hard to set Begin of the insertionup (or both). This leads customers toEnd of the insertion Begin of the deletion up, so theyEnd of the deletion go for external providers which leaves Begin of the insertionthemEnd of the insertion Begin of the deletion customersEnd of the deletion to either accept the data-sovereignty risk or go without AI.

* Sending data to third-party LLM hosters frequently violates DSGVO and may conflict with EU AI Act requirements. Customers carry real legal risk.

* OpenProject has no LLM infrastructure.

<br>


## Pain

* **Shadow AI** – Users copy-paste project data into ChatGPT or similar tools, leaking sensitive information without IT oversight.

* **No Begin of the insertioneasy to setup LLM options available**End of the insertion Begin of the deletion self-hosted AI option in the market**End of the deletion – On-prem and regulated customers have no path to AI features that respects their data sovereignty.&nbsp;


# Business Case

## Reach

Begin of the insertionEspecially important forEnd of the insertion Begin of the deletion _About how many users,End of the deletion customers Begin of the insertionwho chose OpenProject because of data control.End of the insertion Begin of the deletion or potential customers currently have this problem? (Low / Worst Case)_End of the deletion

Begin of the deletion > Add this value to the custom field and delete this section.

End of the deletion ## Impact

Begin of the insertionAI assistance isEnd of the insertion Begin of the deletion _Among relevant customers or prospects, how much value do they get fromEnd of the deletion a Begin of the insertiondecision driver in2026 for project management tools. A fully self-hostable, DSGVO/EU AI Act-compliant AI stack is a genuine differentiator that reinforces why customers chose us. Also unblocks every future AI feature.End of the insertion Begin of the deletion comprehensive solution to this problem? (Conservative case)_End of the deletion

Begin of the deletion > Add this value to the custom field and delete this section.

End of the deletion ## Confidence

Begin of the insertionKey risks:End of the insertion Begin of the deletion _What are the top risk factors that could inhibit our ability to deliver this solution? Please consider how we can mitigate these risks._End of the deletion

Begin of the insertion* Model and inference stack selection requires empirical testing.

* On-prem hardware constraints. Customers may lack accessEnd of the insertion Begin of the deletion > Add this valueEnd of the deletion to Begin of the insertionGPUs orEnd of the insertion the Begin of the insertionfunds for it.

* EU AI Act compliance still evolving.

* Real-time latency requirements for interactive use cases.


End of the insertion Begin of the deletion custom field and delete this section.

End of the deletion ## Urgency and Priority

Begin of the insertionNo AI feature ships without it. Other open source products ship AIEnd of the insertion Begin of the deletion _What isEnd of the deletion the Begin of the insertionwrong way via third-party providers. We haveEnd of the insertion Begin of the deletion relative priority of this opportunity in your backlog? What tradeoffs must you make? Is thereEnd of the deletion a Begin of the insertionwindowEnd of the insertion Begin of the deletion hard deadline or could this wait?_

> Add this valueEnd of the deletion to Begin of the insertionbeEnd of the insertion the Begin of the insertionfirst open-source project management tool that doesEnd of the insertion Begin of the deletion custom field and deleteEnd of the deletion this Begin of the insertionright.End of the insertion Begin of the deletion section.End of the deletion

## Solution

Begin of the insertion<br>

#### Core Principle

All AI processing stays withinEnd of the insertion Begin of the deletion _How do we solveEnd of the deletion the Begin of the insertioncustomer&#39;s controlled environment. No project dataEnd of the insertion Begin of the deletion user’s problem. WhatEnd of the deletion is Begin of the insertionsentEnd of the insertion Begin of the deletion our “pain killer”? What must we achieve in the first version of the solution in orderEnd of the deletion to Begin of the insertionthird-party LLM providers.

#### **Phase 1:**  Research &amp; Benchmarking Spike

* Test candidate open-weight models on our core tasks

* text rewriting and translation

* summarization

* intent classification

* real-time assistance

* Model constraints:

* open-weight

* license-compatible with commercial use

* only as large as needed

* transparent training data provenance

* ethical and environmental footprint considered.

* Test inference runtimes e.g. vLLM, llama.cppEnd of the insertion Begin of the deletion achieve valueEnd of the deletion for Begin of the insertionstreaming, K8s compatibility (and maybe CPU-only viability)

* Benchmark on reference hardware

* **Result should be a decision document with benchmarks, selected stack, hardware requirements, license review, ethical/environmental assessment.**


#### Phase 2: Infrastructure implementationEnd of the insertion Begin of the deletion the user?_End of the deletion

* Begin of the insertionModel-agnostic inference layer behind an OpenAI-compatible API.End of the insertion Begin of the deletion ....End of the deletion

* Begin of the insertion(Helm charts for GPU (+ CPU-only deployment), integrated into existing Helmfile setup.) not sure yet

* API gateway with per-tenant key management, rate limiting, usage logging.

* Needs to be clarified how keys can be managed

* We try avoiding a full UI for it except we can use something already build

* Guardrails middleware e.g. for prompt injection detection including audit log (needs clarification). This should be configurable per deployment.

* Streaming support for real-time use cases.

* Documentation with deployment guide, hardware specs, compliance checklist.End of the insertion Begin of the deletion <br>End of the deletion


## Out of Scope for the MVC

Begin of the deletion _What should NOT be in the minimal viable change, and can be considered for future iterations? Why? Please order them by importance._

End of the deletion * Begin of the insertionFine-tunining

* Multi-model routing

* RAG and semantic search use casesEnd of the insertion Begin of the deletion ...End of the deletion


## Differentiation

Begin of the insertion* **Data sovereignty:** The model runs inside ourEnd of the insertion Begin of the deletion _What do you believe will differentiate us from the current experienceEnd of the deletion or Begin of the insertionthe customer&#39;s infrastructure. No third-party LLM hoster in the loop.

End of the insertion Begin of the deletion competitive experiences?_

End of the deletion * Begin of the insertion**EU AI Act / DSGVO compliance by design**: Guardrails, audit logging, transparency built in from day one.

* **Right-sized, not over-sized:** Smallest model that delivers, keeping hardware realistic and energy consumption honest. With transparent energy consumption reportingEnd of the insertion Begin of the deletion ...End of the deletion


## Next iteration

Begin of the deletion _What is the next solution that would allow us to release meaningful customer value quickly?_

End of the deletion * Begin of the insertionUI for token, guardrail and account managementEnd of the insertion Begin of the deletion ...End of the deletion

* Begin of the insertionMulti-model usageEnd of the insertion Begin of the deletion <br>End of the deletion


# Launch and Growth

## Measures

_How will you know you solved the problem? Please list measurable, quantitative indicators (preferred) or qualitative ways you plan on assessing the solution?_

* ...


## Messaging

_If you were to write a press release, how would you describe the value to customers?_

<figure class="table op-uc-figure_align-center op-uc-figure"><table class="op-uc-table"><tbody><tr class="op-uc-table--row"><th class="op-uc-table--cell op-uc-table--cell_head"><p class="op-uc-p">Headline</p></th><td class="op-uc-table--cell"><p Begin of the insertionclass="op-uc-p">OpenProject enables the secure use of AI features by providing a safe LLM infrastructure for SaaS customers and tested and easy to install self-hosted solutions for on-prem customers</p></td></tr><trEnd of the insertion Begin of the deletion class="op-uc-p"><br data-cke-filler="true"></p></td></tr><trEnd of the deletion class="op-uc-table--row"><th class="op-uc-table--cell op-uc-table--cell_head"><p class="op-uc-p">First Paragraph</p></th><td class="op-uc-table--cell"><p class="op-uc-p"><br data-cke-filler="true"></p></td></tr><tr class="op-uc-table--row"><th class="op-uc-table--cell op-uc-table--cell_head"><p class="op-uc-p">Customer Quote</p></th><td class="op-uc-table--cell"><p class="op-uc-p"><br data-cke-filler="true"></p></td></tr></tbody></table></figure>

## Go to market

_How are you planning on getting this into users&#39; hands?_