Security & governance
The local-first guarantee
Local inference runs on the hardware in front of you, with zero egress by construction. Privacy-first mode pins every query to that lane, and the router still picks the best local model per task.
Most “private” AI tools are a remote service with a privacy policy: your prompt runs on someone else’s GPU. The local lane drops the round trip. The model loads into your RAM, the math runs on your own silicon, and no request leaves the machine during local inference. Cloud lanes exist only if you allow them, and the router’s privacy gate rules them out for pinned work before cost is considered.
Structural, not a policy
The engine has no cloud half. The weights live on your disk, the KV cache lives in your memory, and no code path serializes a prompt into an outbound request. No account, key, or sign-in stands between you and the first token, and the engine never opens a connection of its own.
What stays on the machine
- Weights
- Downloaded once to local storage, then read straight off disk on every load.
- Prompts
- Tokenized and fed to the model in process. Nothing serializes them into an outbound request.
- Generated tokens
- Decode writes to a local buffer and streams to the studio.
- Conversation history
- Chats, agents, and settings persist to local storage on disk. No sync, no account.
The deliberate exits
Three actions on the local lane can reach the network. Each stays off until you ask for it, and inference is in none of them.
| Path | What it sends | Gate |
|---|---|---|
| Model download | An HTTPS GET to a model host for the weights file. | You pick the model to install. |
| Web search | A query goes device-to-provider directly, never through a Conifer server. | Off until you grant it; see the grant model. |
| Updates | A version check against the update endpoint. | No prompt or token data attached. |
When an outbound call fires, the studio logs it to an append-only egress record that keeps the hostname only, never the full URL.
The table has no row for local inference, because loading a model and generating tokens reach the network zero times. A query you allow onto a cloud lane leaves by definition; privacy-first mode means it never does.
Serving stays local too
conifer serve binds to 127.0.0.1 and checks the Host header, which blocks DNS-rebinding tricks from a malicious page. Exposing it beyond the machine takes an explicit --host 0.0.0.0.
conifer serve --model qwen3-8b
# listening on 127.0.0.1:8080 (loopback only)Where the boundary is drawn
| Read next | What it covers |
|---|---|
| The grant model | Deny-by-default authority for agents and tools. |
| Deploy across a team | Holding the posture across a team with no collection server. |