Security & governance
The local-first guarantee
Local inference runs on the hardware in front of you — the inference path itself has zero egress by construction, and privacy-first mode pins every query to that lane. Usage telemetry (metadata only, never your words) is on by default and switchable off; the router still picks the best local model per task.
Most “private” AI tools are a remote service with a privacy policy: your prompt runs on someone else’s GPU. The local lane drops the round trip. The model loads into your RAM, the math runs on your own silicon, and no request leaves the machine during local inference. Cloud lanes exist only if you allow them, and the router’s privacy gate rules them out for pinned work before cost is considered.
Structural, not a policy
The engine has no cloud half. The weights live on your disk, the KV cache lives in your memory, and no code path serializes a prompt into an outbound request. No account, key, or sign-in stands between you and the first token, and the engine never opens a connection of its own.
What stays on the machine
- Weights
- Downloaded once to local storage, then read straight off disk on every load.
- Prompts
- Tokenized and fed to the model in process. Nothing serializes them into an outbound request.
- Generated tokens
- Decode writes to a local buffer and streams to the studio.
- Conversation history
- Chats, agents, and settings persist to local storage on disk. No sync, no account.
The deliberate exits
Four paths on the local lane can reach the network. Inference is in none of them; three stay off until you ask, and the one that is on by default carries metadata only and switches off in one place.
| Path | What it sends | Gate |
|---|---|---|
| Model download | An HTTPS GET to a model host for the weights file. | You pick the model to install. |
| Usage telemetry | Anonymized usage metadata — enums, counts, device class; never prompt or answer text without an explicit content opt-in. | On by default; one switch off in Settings → Privacy & data (Local-only closes it too). |
| Web search | A query goes device-to-provider directly, never through a Conifer server. | Off until you grant it; see the grant model. |
| Updates | A version check against the update endpoint. | No prompt or token data attached. |
When an outbound call fires, the studio logs it to an append-only egress record that keeps the hostname only, never the full URL.
The table has no row for local inference, because loading a model and generating tokens reach the network zero times. A query you allow onto a cloud lane leaves by definition; privacy-first mode means it never does.
Serving stays local too
conifer serve binds to 127.0.0.1 and checks the Host header, which blocks DNS-rebinding tricks from a malicious page. Exposing it beyond the machine takes an explicit --host 0.0.0.0.
conifer serve --model qwen3-8b
# listening on 127.0.0.1:8080 (loopback only)Where the boundary is drawn
| Read next | What it covers |
|---|---|
| The grant model | Deny-by-default authority for agents and tools. |
| Deploy across a team | Holding the posture across a team with no collection server. |