There are deployments through Azure private cloud setups that should pass most requirements. For instance these do not feed back data to openai. We use this and are super cagey regarding any data leaving our systems.

A lot of this seems to be consulting work and not actually software cost. How are they supposed to estimate the necessary number of hours if you haven’t told them what you need.

If you are serious about it, identify a few companies (no fewer than 5) and send them a Request for proposal (RfP) with what you are looking for and let them bid.