{"course":{"slug":"running-models-yourself","title":"Running Models Yourself","url":"https://addaly.com/learn/running-models-yourself","level":"intermediate","track":"deep"},"lesson":{"slug":"local-is-not-automatically-private","title":"Local is not automatically private","url":"https://addaly.com/learn/running-models-yourself/local-is-not-automatically-private","position":9,"of":82,"minutes":8,"answer":"Local weights do not leak, but the application, the plugins.","keyIdea":"Local weights do not leak, but the application, the plugins, the hybrid features and above all your own prompt logs can: verify with a firewall block and a traffic capture rather than trusting the word local."},"body":{"format":"markdown","text":"## The claim people make, and the claim that is true\n\n\"It runs locally, so nothing leaves the machine.\" That is a claim about one component in a system that has several. The model weights running under your own process do not phone anyone. Everything around them might.\n\nIf privacy is the reason you are doing this, and for many people it is the only reason, then the guarantee has to be checked rather than assumed, because it is the sort of guarantee that fails quietly.\n\n## Where the leaks actually are\n\n**The application, not the model.** A desktop chat application that runs a local model may still send crash reports, usage analytics, prompt text for a \"cloud sync\" feature, or embeddings to a hosted vector service. Several popular local-first tools have shipped analytics on by default at some point. The model being local says nothing about the app being local.\n\n**Hybrid features.** Web search, document upload with cloud parsing, a \"use a bigger model for hard questions\" toggle, or an image feature backed by an API. Each is a documented feature and each one sends your text somewhere. The dangerous ones are the automatic ones.\n\n**Model downloads.** Fetching a model tells the host which model you fetched, from which address, when. Harmless in most contexts, not in all.\n\n**Extensions and integrations.** An editor plugin that routes to your local server may still send telemetry about what you typed, and a browser extension has the page contents by definition.\n\n**Your own logs.** A server that logs full prompts to disk has created a plain-text archive of the most sensitive material you own, usually in a directory with default permissions, usually included in whatever backs your home folder up. This is the most common real leak and it is entirely self-inflicted.\n\n## The checks worth doing once\n\nWatch the traffic rather than reading the marketing:\n\n```bash\n# macOS / Linux: what is this process talking to?\nsudo lsof -i -P | grep -i ollama\n\n# a live view of connections from a given binary\nsudo tcpdump -n -i any 'not net 127.0.0.0/8 and not net 10.0.0.0/8'\n```\n\nRun a real session and watch. If a local tool opens a connection you did not expect, find out what it is before continuing. The strong version of this test is to block the process at the firewall entirely and confirm the model still answers; anything that breaks was reaching out for something.\n\nThen check the three configuration items that matter:\n\n- Analytics or telemetry setting in every tool in the chain, including the editor plugin.\n- Whether prompt logging is on, and where the file goes.\n- Whether the server is bound to `127.0.0.1` rather than `0.0.0.0`.\n\n## Privacy from the network is not privacy from the disk\n\nEven with no traffic at all, the sensitive text is on your machine in several places: the log file, the shell history if you used curl, the application's conversation database, the swap file, and any backup. On a laptop that travels, disk encryption is the control that makes the rest of it meaningful: FileVault, LUKS, BitLocker. Without it, \"the data never left my machine\" is true and irrelevant if the machine leaves you.\n\nRetention is the other half. Decide how long conversations are kept and actually delete them. A local assistant that keeps everything forever has built a richer profile of you than most services you worried about.\n\n## What local gives you\n\nHaving named the gaps, the guarantee is still real and it is unusual:\n\n- No third-party processing agreement to negotiate, and no sub-processor list to audit.\n- No question about whether inputs are used for training.\n- No provider-side retention window you do not control.\n- No cross-border transfer, which for some regulated work is the entire point.\n- No dependency on a vendor's continued existence or continued policy.\n\nFor clinical notes, legal discovery, unpublished research, an employer's source code, or other people's private messages, that combination is not a preference. It is often the condition under which the work is permitted at all.\n\n## Two things people get wrong in the other direction\n\nRunning a model locally does **not** make you exempt from data protection law. If you process other people's personal data, the obligations attach to you as the controller (lawful basis, retention, subject access, security) and running the processing on your own hardware makes you responsible for all of it rather than none of it. Being local removes a processor from the chain; it does not remove the duties.\n\nAnd it does not sanitise the input. If you paste a client's data into a local model to summarise it, you have still processed the client's data, and whatever contract governs that processing still applies."},"check":{"question":"A clinic runs a model entirely on its own server, blocks all outbound traffic from the inference host, and enables full prompt-and-response logging so that clinicians can review past summaries. Which risk has this configuration increased?","options":[{"text":"None: with outbound traffic blocked, no patient data can leave, and local logs are inside the same trust boundary as the model.","correct":false,"tempting":"Treats the network boundary as the whole threat model, when the logs are a new copy of the most sensitive data with its own access, backup and retention exposure."},{"text":"Model quality, because logging adds latency that forces a shorter context window.","correct":false,"tempting":"Invents a performance link; log writes are trivial next to inference, and nothing about logging changes the context configuration."},{"text":"It has created a plain-text archive of clinical text, with its own permissions, backups and retention obligations, in a place the security review probably has not considered.","correct":true},{"text":"Regulatory exposure, because processing health data on self-hosted infrastructure requires a data processing agreement with the hardware vendor.","correct":false,"tempting":"Misplaces the duty; buying a server does not make the manufacturer a processor of the data you later put on it."}]},"prev":{"slug":"what-it-will-never-do","title":"The ceiling the weights impose","url":"https://addaly.com/learn/running-models-yourself/what-it-will-never-do"},"next":{"slug":"does-it-fit","title":"Does it fit: the arithmetic","url":"https://addaly.com/learn/running-models-yourself/does-it-fit"},"authorship":"Founder and series editor: Dr Mustafa Mun. Written by AI models to a written standard. Exam keys checked blind by a second model: 3,665 of 3,666 agreed. Academic review invited.","review":{"status":"Draft, open for academic review"},"cite":"Addaly (2026) 'Local is not automatically private', in Running Models Yourself. Edited by M. Mun. Addaly. Available at: https://addaly.com/learn/running-models-yourself/local-is-not-automatically-private (Accessed: 13 October 2026).","licence":{"name":"CC BY-NC-SA 4.0","url":"https://creativecommons.org/licenses/by-nc-sa/4.0/"},"reader":{"schema":1,"title":"Local is not automatically private","courseTitle":"Running Models Yourself","module":{"index":1,"slug":"deciding-to-run-it-yourself","title":"Deciding to run it yourself"},"answer":null,"keyIdea":"Local weights do not leak, but the application, the plugins, the hybrid features and above all your own prompt logs can: verify with a firewall block and a traffic capture rather than trusting the word local.","hero":{"kind":"plate","image":null,"alt":null,"caption":null},"blocks":[{"t":"h2","id":"the-claim-people-make-and-the-claim-that-is-true","runs":[{"text":"The claim people make, and the claim that is true"}]},{"t":"p","runs":[{"text":"“It runs locally, so nothing leaves the machine.” That is a claim about one component in a system that has several. The model weights running under your own process do not phone anyone. Everything around them might."}]},{"t":"p","runs":[{"text":"If privacy is the reason you are doing this, and for many people it is the only reason, then the guarantee has to be checked rather than assumed, because it is the sort of guarantee that fails quietly."}]},{"t":"h2","id":"where-the-leaks-actually-are","runs":[{"text":"Where the leaks actually are"}]},{"t":"p","runs":[{"text":"The application, not the model.","b":true},{"text":" A desktop chat application that runs a local model may still send crash reports, usage analytics, prompt text for a “cloud sync” feature, or embeddings to a hosted vector service. Several popular local-first tools have shipped analytics on by default at some point. The model being local says nothing about the app being local."}]},{"t":"p","runs":[{"text":"Hybrid features.","b":true},{"text":" Web search, document upload with cloud parsing, a “use a bigger model for hard questions” toggle, or an image feature backed by an API. Each is a documented feature and each one sends your text somewhere. The dangerous ones are the automatic ones."}]},{"t":"p","runs":[{"text":"Model downloads.","b":true},{"text":" Fetching a model tells the host which model you fetched, from which address, when. Harmless in most contexts, not in all."}]},{"t":"p","runs":[{"text":"Extensions and integrations.","b":true},{"text":" An editor plugin that routes to your local server may still send telemetry about what you typed, and a browser extension has the page contents by definition."}]},{"t":"p","runs":[{"text":"Your own logs.","b":true},{"text":" A server that logs full prompts to disk has created a plain-text archive of the most sensitive material you own, usually in a directory with default permissions, usually included in whatever backs your home folder up. This is the most common real leak and it is entirely self-inflicted."}]},{"t":"h2","id":"the-checks-worth-doing-once","runs":[{"text":"The checks worth doing once"}]},{"t":"p","runs":[{"text":"Watch the traffic rather than reading the marketing:"}]},{"t":"code","lang":"bash","label":"Bash","text":"# macOS / Linux: what is this process talking to?\nsudo lsof -i -P | grep -i ollama\n\n# a live view of connections from a given binary\nsudo tcpdump -n -i any 'not net 127.0.0.0/8 and not net 10.0.0.0/8'"},{"t":"p","runs":[{"text":"Run a real session and watch. If a local tool opens a connection you did not expect, find out what it is before continuing. The strong version of this test is to block the process at the firewall entirely and confirm the model still answers; anything that breaks was reaching out for something."}]},{"t":"p","runs":[{"text":"Then check the three configuration items that matter:"}]},{"t":"ul","items":[[{"text":"Analytics or telemetry setting in every tool in the chain, including the editor plugin."}],[{"text":"Whether prompt logging is on, and where the file goes."}],[{"text":"Whether the server is bound to "},{"text":"127.0.0.1","code":true},{"text":" rather than "},{"text":"0.0.0.0","code":true},{"text":"."}]]},{"t":"h2","id":"privacy-from-the-network-is-not-privacy-from-the-disk","runs":[{"text":"Privacy from the network is not privacy from the disk"}]},{"t":"p","runs":[{"text":"Even with no traffic at all, the sensitive text is on your machine in several places: the log file, the shell history if you used curl, the application’s conversation database, the swap file, and any backup. On a laptop that travels, disk encryption is the control that makes the rest of it meaningful: FileVault, LUKS, BitLocker. Without it, “the data never left my machine” is true and irrelevant if the machine leaves you."}]},{"t":"p","runs":[{"text":"Retention is the other half. Decide how long conversations are kept and actually delete them. A local assistant that keeps everything forever has built a richer profile of you than most services you worried about."}]},{"t":"h2","id":"what-local-gives-you","runs":[{"text":"What local gives you"}]},{"t":"p","runs":[{"text":"Having named the gaps, the guarantee is still real and it is unusual:"}]},{"t":"ul","items":[[{"text":"No third-party processing agreement to negotiate, and no sub-processor list to audit."}],[{"text":"No question about whether inputs are used for training."}],[{"text":"No provider-side retention window you do not control."}],[{"text":"No cross-border transfer, which for some regulated work is the entire point."}],[{"text":"No dependency on a vendor’s continued existence or continued policy."}]]},{"t":"p","runs":[{"text":"For clinical notes, legal discovery, unpublished research, an employer’s source code, or other people’s private messages, that combination is not a preference. It is often the condition under which the work is permitted at all."}]},{"t":"h2","id":"two-things-people-get-wrong-in-the-other-direction","runs":[{"text":"Two things people get wrong in the other direction"}]},{"t":"p","runs":[{"text":"Running a model locally does "},{"text":"not","b":true},{"text":" make you exempt from data protection law. If you process other people’s personal data, the obligations attach to you as the controller (lawful basis, retention, subject access, security) and running the processing on your own hardware makes you responsible for all of it rather than none of it. Being local removes a processor from the chain; it does not remove the duties."}]},{"t":"p","runs":[{"text":"And it does not sanitise the input. If you paste a client’s data into a local model to summarise it, you have still processed the client’s data, and whatever contract governs that processing still applies."}]}],"check":{"question":[{"text":"A clinic runs a model entirely on its own server, blocks all outbound traffic from the inference host, and enables full prompt-and-response logging so that clinicians can review past summaries. Which risk has this configuration increased?"}],"options":[{"text":[{"text":"None: with outbound traffic blocked, no patient data can leave, and local logs are inside the same trust boundary as the model."}],"correct":false,"tempting":[{"text":"Treats the network boundary as the whole threat model, when the logs are a new copy of the most sensitive data with its own access, backup and retention exposure."}]},{"text":[{"text":"Model quality, because logging adds latency that forces a shorter context window."}],"correct":false,"tempting":[{"text":"Invents a performance link; log writes are trivial next to inference, and nothing about logging changes the context configuration."}]},{"text":[{"text":"It has created a plain-text archive of clinical text, with its own permissions, backups and retention obligations, in a place the security review probably has not considered."}],"correct":true,"tempting":null},{"text":[{"text":"Regulatory exposure, because processing health data on self-hosted infrastructure requires a data processing agreement with the hardware vendor."}],"correct":false,"tempting":[{"text":"Misplaces the duty; buying a server does not make the manufacturer a processor of the data you later put on it."}]}],"order":[3,1,2,0],"why":null},"prev":{"slug":"what-it-will-never-do","title":"The ceiling the weights impose","minutes":8},"next":{"slug":"does-it-fit","title":"Does it fit: the arithmetic","minutes":9}}}