Your AI Fellow Can Now Work Inside Your Private Network

Here is an uncomfortable truth about most AI tools: they can only help with the parts of your business that live on the public internet.

Your email? Sure. Your Google Docs? Fine. Anything with a slick modern API? No problem.

But think about where your business actually runs. The file server in the office with fifteen years of client documents. The CRM you self-host because it holds everything. The practice management system on a machine down the hall. The database behind your firewall that three departments depend on.

None of that is on the internet. On purpose. And every AI assistant you have ever tried has been locked out of all of it.

That changes today. FellowHire fellows can now connect directly to your private network — securely, over VPN — and work with the systems that were never meant to be public.

What this looks like in practice

One of our customers is a collections law firm. Their world runs on two systems: a file server in their office holding decades of case documents, and a self-hosted CRM that has never touched the public internet — and never will.

Their fellow works with both. Every day.

A staff member asks the fellow who handles a specific homeowners association, and the fellow looks it up. Someone needs a document pulled from a case file on the office server, and the fellow retrieves it. A new account needs to be checked against the CRM before opening, and the fellow checks it — in the same system the rest of the team uses, on their own network, behind their own firewall.

No exports. No syncing sensitive files to some third-party cloud. No "sorry, I can't access that." The fellow simply works where the firm's systems live.

What kinds of systems can a fellow reach?

If it is on your network, a fellow can likely work with it:

• File servers and network drives — the office share where the real documents live
• Self-hosted CRMs and practice management systems — the ones with no public API
• Internal databases — reporting, inventory, line-of-business data
• Intranet tools and internal web apps — the systems only employees can see
• Private cloud environments — workloads in your own VPC or datacenter

And a fellow is not limited to one network. If your business spans an office, a datacenter, and a private cloud, a fellow can hold connections to multiple private networks at the same time — and work across all of them.

Reaching the network is half the story. A fellow can now also operate the Windows desktop applications running on those machines — the legacy billing systems and line-of-business software that never got an API.

Why this matters more than another integration

Most AI products publish a list of integrations: a few hundred cloud apps with public APIs. If your system is on the list, great. If it is not — and the systems that run your business often are not — you are stuck.

Cloud-only AI assistants — most of the tools we get compared to — live entirely on the public internet, and can only reach what the public internet can reach. For a lot of real businesses — law firms, medical practices, manufacturers, property managers, IT service providers — that means the most important systems are permanently out of scope.

Private network access flips that. Instead of asking "is my system on the integration list?", the question becomes "is my system on my network?" If the answer is yes, your fellow can work with it.

That is the difference between an AI that can use your email and an AI that can work at your company.

For the technical folks: how it actually works

If you are the business owner, feel free to skip to the end. If you are the IT partner who gets asked "is this safe?" — this section is for you.

It's an outbound, split-tunnel VPN connection. Each fellow runs in its own isolated environment, and that environment establishes an outbound VPN client connection into your network. Outbound means you do not open a single inbound port on your firewall. There is nothing new for the internet to find.

Only the routes you specify go through the tunnel. Split-tunnel means you tell us exactly which internal subnets the fellow may reach — say, the file server's subnet and the CRM host — and only traffic to those destinations traverses the VPN. Everything else the fellow does stays on its normal path. The fellow gets access to what you scoped, and nothing more.

Split-DNS resolves your internal hostnames. If your systems live at names like crm.corp.example.com, the fellow resolves those through your resolver — but only for the search domains you configure. Your internal DNS stays internal.

Nothing gets installed on your servers. No agents, no connectors, no software on your machines. The fellow connects to your network the same way a remote employee's laptop would — through the VPN server you already run, with credentials you issue and can revoke at any time.

Your data stays where it lives. The fellow reaches into your network to do its work; your documents and records are not bulk-synced out to a third-party platform. And the whole setup runs on the same SOC-compliant infrastructure as everything else we do.

Multiple networks, independently scoped. Each VPN connection is configured and scoped separately, so a fellow that works across your office and your datacenter has exactly the access you granted on each — no more.

What it takes to set up

If you already have a VPN server (most businesses with remote workers do), setup is a profile and a short conversation about which systems the fellow should reach. It happens during your fellow's regular onboarding week. If you have an IT partner or MSP, they will feel right at home — and if you do not have a VPN yet, we will walk you through the simplest path.

The bottom line

Your most important systems are not on the internet, and they should not be. Until now, that meant AI could not help with the work inside them.

A FellowHire fellow works where your systems live — the office file server, the self-hosted CRM, the internal database, the private cloud. Securely, with access you scope and control.

If that sounds like the missing piece, set up a fellow and tell us what your fellow needs to reach. Or ask your IT partner to read the technical section above — we are happy to get them on the setup call.