The room is the perimeter.

We are deploying a clinical system for a single-chair practice that ran on paper. The reflexive architecture for this job in 2026 is a hosted one: a virtual machine in some region, a VPN back to the clinic, a monthly bill, a dashboard. That was our first design too. Then we deleted it.

What is going in instead is one machine, in the clinic, running everything. No hosted VM, no VPN, no cloud dependency. The recurring infrastructure cost fell from real money to nearly nothing, but the money is the least of it. The interesting change is what happened to the threat model: patient records that never leave the room cannot be caught in a provider breach, cannot be subpoenaed from a third party, cannot be misconfigured into a public bucket, and cannot transit a network they were never on. An entire class of failure does not have to be defended against, because it structurally cannot occur.

One of our standing principles says the network forgets what it never knew. This is that principle at its bluntest. Privacy engineering mostly means adding controls: encryption, policies, audits. The stronger move, when the job allows it, is subtraction. Every system the data does not touch is a system that cannot leak it, and a perimeter you can point at, a door with a lock, is one a small practice can actually reason about.

What the room demands in return

Locality concentrates risk instead of eliminating it. One machine in a room can be stolen, can burn, can die quietly on a Tuesday. So the architecture's honesty depends on the unglamorous discipline that travels with it: encrypted disks, and backups whose restores were rehearsed before go-live. The room being the perimeter does not mean the room is trusted. It means the list of things to distrust finally fits on one page.

This is not anti-cloud doctrine. A multi-site practice, a team that needs concurrent remote access, a workload that outgrows one box: the calculus changes, and hosted infrastructure earns its place. The doctrine is smaller: default to the smallest system that carries the job, and make the data ask permission to travel, rather than asking permission to stay.