Small Japanese Companies Get a Fully Closed, Private AI System

The company that stops before pressing Send

A care provider has assessment notes and client records stacked on a desk. A small metalworking company has customer drawings and quotation costs in a shared folder. An insurance agency holds accident reports; a labor consultant holds payroll and attendance data. A generative-AI service could summarize, reconcile and draft the paperwork quickly. Then the employee reaches the prompt box and stops. Where will this information go, who will process it, and when will it be deleted?

ROOTA’s story begins with that destination, before the answer appears. KTGS says registered documents, chats and audio are not sent to an external AI service. Processing takes place in a closed environment at a domestic data center or on hardware installed at the customer’s premises. Even invitations, notifications and password setup avoid an outside email-delivery service. ROOTA is developed by Knowdel Co., which lists the same Nakano address; KTGS, founded in 2022, is the general agent responsible for implementation, operation and maintenance.

The product is organized around three verbs: find, make and protect. It searches rules and manuals with citations, drafts minutes, reports and email, and checks documents against company rules before submission. Users can select an “AI role” to change perspective and tone. KTGS will individually develop the first task-specific agent without a separate development fee. The design motto is “people make the judgment; AI does the preparation.” In care, law, taxation, subsidies and real estate, the company says a qualified professional or responsible employee retains the final decision.

Three plans, three different boundaries

The phrase “fully closed” can flatten important architectural differences. Under ROOTA’s shared plan, multiple customers use infrastructure in a Japanese data center, with data separated structurally by company and department, according to the vendor. Under the dedicated plan, the customer’s data and model are placed in a dedicated environment. Under the on-site plan, the server sits inside the customer’s facility and the customer manages the data and model.

Dollar equivalents use the supplied rate of ¥162.49 to the dollar. The figures are minimums. Each additional user costs ¥5,000 a month, and vendor-built agents after the first cost ¥30,000 each. KTGS cautions that GPU and LLM-server market conditions can change the configuration and initial fee. “First agent free” does not mean the platform setup or subscription is free.

The vocabulary matters. A closed network describes a processing path that does not send registered data to an outside AI service. On-premises means hardware is located in the customer’s facility. Under the U.S. National Institute of Standards and Technology’s definition, a private cloud is provisioned for the exclusive use of one organization and can be on or off premises. An air gap removes or stringently isolates routes to other networks. ROOTA’s public material does not call the system air-gapped, and its shared plan should not be confused with a single-customer private cloud.

Japanese small businesses once owned a dedicated computer

A computer inside a small company is not merely a futuristic idea in Japan. It is also a memory. According to the Information Processing Society of Japan’s Computer Museum, the country began developing the office computer, or ofukon, in the early 1960s for invoices and ledgers. Casio’s TUC Compuwriter, NEC’s NEAC-1201 and Unoke Denshi’s USAC-3010 appeared in 1961. Mitsubishi Electric first used the term “office computer” for its MELCOM 81 in 1968.

American small companies often ran business applications on general-purpose minicomputers. Japanese makers instead assembled hardware, operating system, peripherals and development language specifically for office work. Because customers often lacked computer specialists, the systems emphasized direct interaction and Japanese input. Through the 1970s and 1980s, they raised productivity in invoicing, sales, inventory and payroll across small and midsize companies. Data lived on the machine and its local terminals. The boundary was visible.

That visibility came with lock-in, maintenance contracts, hardware replacement, backup duties and weak disaster resilience. Personal computers and open systems took over in the 1990s. In the 2000s, software as a service and cloud computing converted equipment purchases into subscriptions. NIST’s 2011 definition described cloud as on-demand network access to a shared pool of configurable resources that could be provisioned and released quickly. The small company escaped the server room; its boundary moved into contracts, identities, encryption and distant data centers.

Generative AI moved the boundary again

In a conventional accounting service, users send expected numbers into expected fields. With generative AI, an employee can combine a customer’s name, a contract clause, medical history and an unreleased product in a single free-form prompt. Input is difficult to predict and output is probabilistic. In June 2023, Japan’s Personal Information Protection Commission warned businesses that entering personal data without consent could violate the law if a generative-AI provider used it for a purpose beyond returning the requested output. It told businesses to confirm, among other things, that a provider would not use the data for machine learning.

Major enterprise cloud-AI services can offer no-training commitments, encryption, Japanese regions and audited controls. “Cloud AI” therefore does not mean “unprotected.” ROOTA responds to a narrower and more demanding policy: some companies do not merely want a contract prohibiting secondary training. They do not want the prompt body sent to an outside model API at all. Reducing processing locations can be valuable for nondisclosure agreements, municipal work, care records and product drawings.

A domestic data center is still outside the customer’s office. In the shared and dedicated plans, the trust boundary includes KTGS and relevant facility operations. Residency reduces some jurisdictional and transfer concerns. It does not eliminate stolen credentials, insider action, misconfiguration, compromised browsers or leaked backups. Privacy is not geography alone. It is a set of permissions and operating practices.

Open weights changed the price of local AI

Until recently, running a fluent language model entirely inside a company required large-company computing and scarce researchers. Three technologies lowered the barrier. Open-weight models can be downloaded and run locally. Embedding models turn text into numerical representations so semantically related passages can be found. Retrieval-augmented generation, or RAG, sends those passages to a language model when answering a question.

Patrick Lewis and co-authors introduced RAG in a 2020 paper that combined a model’s internal, parametric memory with an external searchable memory. A company can update a policy index without retraining the entire language model and can more readily show sources behind an answer. Yet “the answer has a citation” is not the same as “the conclusion is correct.” Retrieval can select an obsolete version, split a table incorrectly or miss a decisive exception; the generator can add a condition not found in the evidence.

ROOTA says it uses Google’s Gemma for text generation and image understanding, OpenAI’s Whisper for speech recognition, and Ruri for Japanese retrieval. Whisper’s code and model weights were released under the MIT License. Gemma is an open-weight family subject to Google’s own terms of use. Those facts are why “open model” is safer here than treating every component as identical open-source software. The vendor has not published which Gemma generation or size it uses, the quantization, the versions of Whisper and Ruri, or the GPU configuration. Speed, accuracy, simultaneous capacity and energy use depend heavily on those choices.

Why small business, and why now?

SMEs and small businesses account for 99.7% of Japanese enterprises, around 70% of workers and roughly half of added value. Under severe labor constraints, minutes, reporting and document search are credible targets for automation. In the Japan Chamber of Commerce and Industry’s November 2025 survey, 36.0% of SMEs used generative AI company-wide, in selected departments or at the option of individual employees. Another 32.4% were considering it, putting the positive group at 68.4%.

Document creation and summarization led intended or actual uses at 78.6%, followed by research and ideas at 58.1%—precisely the internal desk work ROOTA targets. The obstacles tell the other half of the story. Among users, 64.4% worried about accuracy and 43.7% about creating internal rules. Among nonusers, 40.2% could not identify a suitable task, the same 40.2% lacked capable employees or worried about training cost, and 31.3% cited implementation and maintenance expense. Fear of data leaving is only one barrier.

In 2026, Japan’s Small and Medium Enterprise Agency renamed its IT Implementation Subsidy the “Digitalization and AI Implementation Subsidy,” explicitly supporting tools that include AI. The policy is a tailwind, but eligibility depends on registration, category and each application. ROOTA’s public launch material does not identify it as an approved subsidized tool; buyers should not assume reimbursement.

A closed network still has doors

NIST’s zero-trust principle grants no implicit trust solely because a user or device sits on a local network rather than the internet. A closed AI still has a login page, browsers, uploads, administrators, maintenance updates and backups. If a stolen sales account can retrieve human-resources files, information has leaked even though the model never contacted a foreign server.

RAG introduces its own doors. A supplier PDF can contain an instruction that is hard for a person to see but tells the model to ignore its previous rules—an indirect prompt injection. Someone can poison the knowledge base by placing a false policy in an approved folder. Documents with different access rights can enter the same vector index, where a weak query-time filter exposes the wrong passage. The OWASP Top 10 for LLM applications includes prompt injection, sensitive-information disclosure, supply-chain weaknesses, data poisoning, improper output handling, excessive agency and weaknesses in vectors and embeddings.

ROOTA publishes several useful design claims: separation by company and department, an interface that does not expose conversation bodies to administrators or operators, and audit logs. The July 21 release and product page do not, however, detail encryption at rest and in transit, ownership of keys, multifactor authentication, privileged support access, backup location, vulnerability-remediation deadlines, penetration tests, a software bill of materials, service levels, recovery objectives, incident-notification timing or certified deletion. KTGS publishes an information-security policy stating that it has introduced an ISMS and performs internal audits, but the launch material does not identify a third-party certification number. A buyer should verify these controls in tests and contract rather than let the word “closed” stand in for them.

An AI without outside access also lacks outside news

Closing the boundary has a functional cost. Laws, subsidy rules, product specifications and public calls for applications change. An AI that cannot search outside knows only the materials imported into it. That is a strength when the task is to answer from a company policy. It becomes a maintenance obligation when drafting a subsidy application or legal review. Someone must obtain the latest primary source through an approved route, validate it and retire the old version.

Speech recognition has the same chain of risk. Keeping a meeting recording local can be valuable, but Whisper can mistranscribe a proper noun, a dialect or speech under factory noise; the summarizing model can turn the wrong transcript into a smooth, confident paragraph. OCR errors in a contract table, PDF reading order, handwritten notes and red annotations compound across ingestion, retrieval, generation and output.

ROOTA’s site says that the more correct material a company supplies, the more correct the answer becomes. That is directionally sensible, not a guarantee. Two valid policies may conflict, a rescinded rule may remain in a folder, or the real exception may exist only in someone’s memory. AI is not a spell that conceals a disordered file server. It is often an audit that reveals the disorder.

The total cost behind ¥50,000 a month

A ¥50,000 subscription for ten users brings private AI closer to a departmental budget than a research program. The invoice is still not the total cost. People must remove duplicate files, classify secrets, repair permissions, build a set of correct answers, train employees, conduct monthly evaluations, correct failures and disable departing users. The on-site plan adds electricity, cooling, spares, field service and disaster recovery.

Continuity matters as much as model technology when the supplier is small. KTGS was founded in 2022 and lists its staff count as “a small number.” Knowdel shares its address. The public launch material does not offer named production customers, measured answer accuracy, load testing or an independent evaluation. A young small vendor can innovate quickly; the observation is not a verdict on the product. It is a reason to specify the division of responsibility between developer, distributor and operator, data portability, support if the business changes, model-license changes, parts supply, configuration handover and possibly escrow.

Build 50 tests—and the exit—before deployment

A pilot should not begin by ingesting every secret in the company. Choose one narrow task whose answer and access rules can be verified: travel-expense policy, one quality procedure, or product FAQs stripped of customer data. ROOTA itself offers a supported trial. The value of a trial is not an attractive demonstration. It is a catalog of how the system fails.

Question volume is a weak measure. Track time spent searching and drafting, overlooked errors, arrival at the correct source, escalation to a human, percentage of documents reviewed on schedule, and quality before and after deployment. If staff still need to find the original document after every polished answer, the system has not won as an institutional memory.

Not a return to the server room—a redesign of the boundary

ROOTA is not a machine that sends the Japanese SME back to the office computer of 1968. The old ofukon enclosed both business logic and data in a proprietary appliance. Local AI imports model weights and techniques developed around the world while keeping the customer’s inference data closer. It is less a sealed box than a gate that opens selectively.

That gate gives a new option to businesses that cannot send customer information to an outside API and have responded by banning employees from AI altogether. A starting price of ¥50,000 a month, domestic processing, cited retrieval and explicit human judgment address real barriers. The maturation of open-weight models has genuinely expanded the ability of a small organization to choose its data boundary.

The product is also not yet generally available, and its use cases are projections. Evidence for closed processing, retrieval quality, security, support capacity and economics will come not from the sign on July 31 but from later audit logs, incident handling, customer measurements, disclosure of failures and deletion at the end of a contract. Privacy is not the name of a place. It is the daily discipline of deciding who may handle what, why and for how long.