# Self-Host AI Inside Excel, Word, PowerPoint & Outlook > Self-hosted Office / Microsoft 365 add-in: Excel financial modeling, Word contract review, PowerPoint decks, Outlook inbox — wired to your own model gateway, data never leaves the network, zero pivot dependency, Entra SSO + Purview label gating. Canonical: https://www.gatellm.io/use-cases/self-hosted-office-ai/ A self-hosted Office add-in wired to your own model gateway — all four hosts, data never leaves your network, zero pivot dependency. Financial modeling, contract review, and email handling stay in-house. ## Where enterprises actually get stuck The classic dilemma of putting AI into Office: official Copilot routes through Microsoft's cloud, so contracts, financial models, and diligence materials fail compliance the moment they leave the network; yet rolling your own stalls on "where does the add-in even come from" — nearly every Office add-in loads from some SaaS origin by default and phones home on first launch, which hands the data-sovereignty problem right back. Excel financial models, Word contracts, and Outlook threads are exactly the things you must not leak and most want to accelerate. ## How GateLLM does it GateLLM ships a standalone, self-contained Office add-in: the pre-bundled add-in SPA is served from your own HTTPS static host, the manifest points at your origin, and at runtime it talks directly to your own model gateway. Across four hosts (Excel / Word / PowerPoint / Outlook) it bundles 33 domain skills (financial modeling, contract review, inbox triage, etc.), and combined with your BYOK gateway, sensitive data stays entirely in-network. Runtime dependency on pivot is zero — not even first launch phones home. ## 5 levers that actually land - Self-hosted add-in: pre-bundled SPA served over your own HTTPS, manifest pointing at your origin, zero pivot dependency at runtime - 33 bundled skills across four hosts: Excel financial modeling (DCF / LBO / 3-statement), Word contract review (playbook-graded / redline), Outlook inbox (triage / meeting-prep) - Entra SSO + gateway auth: entra_sso turns the user's Entra token directly into the gateway Bearer, so auth and billing track the real user - Purview label gating: access_policies match sensitivity-label GUIDs to block addin.access / file.upload, disabling the add-in or attachment upload on confidential docs - Data stays local: chat history and config live in the browser's local storage with no server copy; a read-only export script audits, and swapping manifests keeps data ## FAQ ### Will the add-in leak data to a third party? No. The self-hosted add-in has zero pivot dependency at runtime; requests go straight to your own model gateway, and the bundled Sentry / GrowthBook defaults are scrubbed off. The only remaining external dependencies are your own gateway, Microsoft Entra / Graph (Office auth and mail/calendar), and your own bootstrap endpoint (if used). ### How do I disable the add-in on a class of confidential documents? Use access_policies to deny addin.access by Microsoft Purview sensitivity-label GUID — the add-in refuses to run on documents carrying that label; file.upload similarly refuses attaching files that carry a restricted label. GUIDs stay stable across renames and locales. - [Full how-to: Self-hosted Office add-in (docs)](https://docs.gatellm.io/en/howto/deploy-office-addin) ## Related - [Home](https://www.gatellm.io/index.md) - [Pricing](https://www.gatellm.io/pricing.md) - [Cost Calculator](https://www.gatellm.io/calculator.md) - [About](https://www.gatellm.io/about.md) - [Book a Demo](https://www.gatellm.io/demo.md) - [FAQ](https://www.gatellm.io/faq.md) - [Compare AI Gateways](https://www.gatellm.io/compare.md) - [Compare LiteLLM](https://www.gatellm.io/compare/litellm.md) - [Compare OpenRouter](https://www.gatellm.io/compare/openrouter.md) - [Compare Alibaba Cloud AI Gateway](https://www.gatellm.io/compare/alibaba-cloud.md) - [Compare Azure API Management](https://www.gatellm.io/compare/azure-apim.md) - [Compare Apigee](https://www.gatellm.io/compare/apigee.md) - [Compare Cloudflare AI Gateway](https://www.gatellm.io/compare/cloudflare.md) - [Compare Kong AI Gateway](https://www.gatellm.io/compare/kong.md) - [Compare Portkey](https://www.gatellm.io/compare/portkey.md) - [LiteLLM vs Kong AI Gateway](https://www.gatellm.io/compare/litellm-vs-kong.md) - [LiteLLM vs OpenRouter](https://www.gatellm.io/compare/litellm-vs-openrouter.md) - [LiteLLM vs Portkey](https://www.gatellm.io/compare/litellm-vs-portkey.md) - [Use Cases](https://www.gatellm.io/use-cases.md) - [Reduce LLM Cost](https://www.gatellm.io/use-cases/reduce-cost.md) - [High Availability](https://www.gatellm.io/use-cases/high-availability.md) - [Multi-Tenant Isolation](https://www.gatellm.io/use-cases/multi-tenant.md) - [Compliance & Audit](https://www.gatellm.io/use-cases/compliance-audit.md) - [Troubleshooting by Symptom](https://www.gatellm.io/use-cases/troubleshooting.md) - [Mixed Multi-Vendor Model Stack](https://www.gatellm.io/use-cases/mixed-model-stack.md) - [Token Usage Visibility & Attribution](https://www.gatellm.io/use-cases/token-ops.md) - [Token FinOps: AI Cost Allocation & Control](https://www.gatellm.io/use-cases/token-finops.md) - [MCP Tool Governance](https://www.gatellm.io/use-cases/mcp-tool-governance.md) - [Web Search for Every Model](https://www.gatellm.io/use-cases/web-search-grounding.md) - [Multi-Key Rotation & Standby](https://www.gatellm.io/use-cases/multi-key-pooling.md) - [Admission Control for Connected Clients](https://www.gatellm.io/use-cases/client-admission-control.md) - [Enforce Which Model Agents Actually Run](https://www.gatellm.io/use-cases/enforce-model-policy.md) - [No Model Choice on the Client](https://www.gatellm.io/use-cases/automatic-model-tiering.md) - [One Protocol, Any Model](https://www.gatellm.io/use-cases/one-protocol-any-model.md) - [Office / Microsoft 365 Add-in](https://www.gatellm.io/office-addin.md) - [Glossary](https://www.gatellm.io/glossary.md) - [Model Catalog](https://www.gatellm.io/models.md) - [SDK & Framework Integrations](https://www.gatellm.io/integrations.md) - [AI Coding Agents & Harnesses](https://www.gatellm.io/coding-agents.md) - [Security & Compliance](https://www.gatellm.io/security.md) - [Privacy Policy](https://www.gatellm.io/privacy-policy.md) - [Terms of Service](https://www.gatellm.io/terms.md) - [Cookie Policy](https://www.gatellm.io/cookies.md) - [Data Processing Agreement (DPA)](https://www.gatellm.io/dpa.md) - [Sub-processor List](https://www.gatellm.io/subprocessors.md) - [Security Questionnaire (CAIQ/SIG/VSA)](https://www.gatellm.io/trust.md) - [Incident Response & Support](https://www.gatellm.io/sla.md) - [Vulnerability Disclosure Policy](https://www.gatellm.io/vulnerability-disclosure.md) - [Open Source License Notice](https://www.gatellm.io/open-source-licenses.md) - [Version Support & Lifecycle (EOL)](https://www.gatellm.io/lifecycle.md) - [Engineering Blog](https://www.gatellm.io/blog.md) - [Your Agents Have More Permissions Than Your Employees: Governing MCP Tools at the Gateway](https://www.gatellm.io/blog/mcp-tool-governance.md) - [The $10k Invoice Problem: Five Ways to Cut LLM Spend Without Dumbing Down Your App](https://www.gatellm.io/blog/reduce-cost.md) - [Your Vendor's List Price Is Not Your Cost: Applying Real FinOps to Token Spend](https://www.gatellm.io/blog/token-finops.md) - [llms.txt](https://www.gatellm.io/llms.txt)