Onpremloom

Payroll and HR teams handle compensation, tax, garnishment and employment-event data that can be inappropriate for a cloud-routed assistant. The supplied research confirms an open-source payroll engine with a live tool interface, documented service surface and containerized deployment, while reviewed commercial payroll assistants route through cloud services. It found no reviewed commercial product combining local inference, zero vendor visibility and a managed rule-update layer. That is a bounded product gap, not proof of demand or a long-lived moat.

Onpremloom would run inside a customer-controlled environment with read-only access to an approved payroll replica or export. It would preserve organization, source system, snapshot, freshness, worker identifier, employment event, pay line, jurisdiction assertion, user question, generated query, tool request, tool result, cited row, model and artifact version, answer draft, uncertainty, specialist finding, correction, rule-bundle version, test result, owner approval, deployment and source readback as distinct records.

Local processing does not prove isolation, security or lawful handling. Administrators still control networks, logs, backups, model files, credentials and updates. A cited row can be stale or misunderstood. A compiled rule can be syntactically valid and legally wrong. Monthly regulatory updates are vendor assertions until a qualified payroll, tax or legal owner confirms applicability, tests them against customer facts and approves activation.

The pilot should use synthetic or de-identified fixtures and a read-only replica, with outbound traffic disabled and independently verified. No agent may change payroll, employment, tax, time, benefits or bank data; submit a run; issue legal conclusions; or rank workers. The buyer hypothesis spans payroll operations, security and IT at regulated or privacy-sensitive employers, but organization size, jurisdictions, deployment capacity, budget and current alternatives remain unverified.

A payroll operations, security or IT owner at a privacy-sensitive employer able to operate a self-hosted service and govern read-only payroll access.