Governance Engine Setup

Overview

PillarShield's On-Premise Engine lets you run governance checks locally on your own infrastructure. Content is evaluated on your servers using your own AI models, while audit logs are securely transmitted to PillarShield's cloud for dashboard access and compliance reporting.

This approach is ideal for organizations with data residency requirements, air-gapped environments, or teams that want to leverage their own GPU hardware for AI-powered checks.

How It Works

Your CMS (Drupal, WordPress, or custom integration) sends content to the local engine instead of the cloud API.
The engine runs all governance checks locally — PII detection, tone analysis, prohibited terms, and moderation.
AI-powered checks use a local LLM served via any OpenAI-compatible API (e.g., LM Studio, Ollama, vLLM, or Text Generation Inference).
Audit logs are transmitted to PillarShield's cloud so your team retains full visibility in the audit log dashboard.

The engine exposes the same /governance endpoint with the same request and response contract as the cloud API. No CMS plugin changes are required — just update the endpoint URL.

Prerequisites

PHP 8.1+ with the curl, mbstring, openssl, and zip extensions enabled.
Composer for dependency management.
A PillarShield API key from pillarshield.co on a Protect or Managed plan.
An OpenAI-compatible LLM server for AI-powered checks (optional — the engine runs deterministic checks without one).

Recommended Models

The engine works with any model served via an OpenAI-compatible chat completions API. We recommend:

Qwen 3.5 35B-A3B (Q4) — fast MoE architecture, ~12 GB VRAM. Best balance of speed and quality.
Qwen 2.5 32B Instruct (Q6) — dense model, ~24 GB VRAM. High quality, slower inference.
Qwen 3.5 9B — lightweight option for limited hardware, ~6 GB VRAM.

Installation

Step 01 — Download

Clone or download the PillarShield engine package and install dependencies:

composer install --no-dev --optimize-autoloader

Step 02 — Configure

Set the following environment variables for your deployment:

Variable	Required	Description
`PILLARSHIELD_MODE`	Yes	Set to `engine`
`PILLARSHIELD_API_URL`	Yes	Set to `https://api.pillarshield.co`
`LLM_BACKEND`	No	`openai` for local LLM, `none` to skip AI checks. Default: `none`
`LLM_API_BASE`	If LLM	Your LLM server URL including `/v1` suffix, e.g. `http://localhost:8000/v1`
`LLM_MODEL`	If LLM	Model identifier as reported by your LLM server, e.g. `qwen3.5-35b-a3b@q4_k_m`
`LLM_TIMEOUT`	No	LLM request timeout in seconds. Default: `12`. Recommended: `30` for local inference.

Step 03 — Start

Start the engine using PHP's built-in server or your preferred web server:

php -S 0.0.0.0:8081 server.php

For production deployments, use Nginx or Apache as a reverse proxy with PHP-FPM.

Step 04 — Verify

Test the engine with a curl command:

curl -X POST http://localhost:8081/governance -H "Content-Type: application/json" -d '{"api_key":"YOUR_PSK_KEY","content":"Test content here"}'

A successful response returns JSON with a status field of COMPLIANT or VIOLATION_DETECTED.

Connect Your CMS

Drupal

In your PillarShield module settings at Administration → Configuration → Content Authoring → PillarShield Governance, change the API endpoint to your engine URL:

http://your-engine-host:8081/governance

If your Drupal site runs in Docker or DDEV, use http://host.docker.internal:8081/governance to reach the engine on your host machine.

WordPress

In Settings → PillarShield, update the API endpoint to your engine URL. You can also define PILLARSHIELD_ENGINE_URL in wp-config.php.

Custom Integrations

Point your existing API integration at the engine URL. The request and response format is identical to the cloud API — see the API reference.

Docker Deployment

For containerized deployments, use the provided Dockerfile or set environment variables in your docker-compose.yml:

services:
  pillarshield-engine:
    image: pillarshield/engine:latest
    ports:
      - "8081:8081"
    environment:
      PILLARSHIELD_MODE: engine
      PILLARSHIELD_API_URL: https://api.pillarshield.co
      LLM_BACKEND: openai
      LLM_API_BASE: http://llm-server:8000/v1
      LLM_MODEL: qwen3.5-35b-a3b@q4_k_m
      LLM_TIMEOUT: "30"

Troubleshooting

LLM checks skipped: Verify your LLM server is running and the LLM_API_BASE URL is correct. The URL must include the /v1 suffix. Check the model name matches exactly what your server reports at GET /v1/models.
Timeout errors: Local LLM inference can take 5–15 seconds depending on model size and hardware. Increase LLM_TIMEOUT to 30 or higher.
Audit ingest failed: The engine needs outbound HTTPS access to api.pillarshield.co to submit audit logs. Verify your firewall or proxy allows this.
CMS connection refused: If your CMS runs in Docker, use host.docker.internal instead of localhost to reach the engine on the host.

On-premise Installation Guide