Several clients cannot or will not send plant data to a cloud account. The model runs on a box inside the plant. Here is what went wrong in the first year, and what we changed.
Power
The server rebooted eleven times in a month during the monsoon. The pipeline did not resume cleanly. Now everything is idempotent, runs from a scheduler that survives restarts, and reports its last successful run on the dashboard so a gap is visible.
The person
The plant's IT engineer maintains the ERP, the CCTV, the Wi-Fi, the printers and now our server. We write the runbook for someone with an hour a week, not a data engineer: three commands, a health page, and a phone number.
Model drift
A line was retooled and the model's inputs changed shape. The alerts quietly became noise. We added a monthly check that compares predicted to actual failures and flags when the gap grows, with retraining as part of the retainer.
What we would not change
Keeping it on-premise. For this client the trust it created was worth more than any convenience the cloud would have given us.