[specialist]

We basically did that for healthcare (electronic medical records) in the mid 2000s. Our customers (actual users) loved us.

Like your enterprises, no hospital (or equiv) would consider exfiltrating their data.

So our gear was physically deployed and operated on each hospital's own system. Our marketing and sales goons called this our "federated data model", which had no tangible connection to reality.

I likened the experience to building model ships in a bottle, while wearing mittens, while someone is punching you in the face. To mitigate, we created what would now be called CI/CD pipelines. We managed 100s of deployments with near zero downtime and effortless rollbacks. I'm rueful just thinking about it.

This strategy didn't survive the 2008 economic crash.