>run it through your IT operations in your own onsite/cloud/whatever to both utilise your local accessing rights but also to make sure data never leaves you.

would a docker deployment to be hosted on your public sector cloud vendor OK ?