A private AI assistant that doesn't send your data anywhere

“Private AI” is claimed more often than it is true. The useful question is not whether a vendor promises privacy but which bytes leave the machine, and how you would know.

Three different claims

“We don’t train on your data.” A policy. It can change, and it says nothing about retention, subpoenas, or breaches.

“Your data is encrypted.” Usually in transit and at rest on their disk — with their keys. The provider can still read it.

“Your data never leaves your hardware.” A structural property. Verifiable, and the only one that survives a change of ownership or terms.

Only the third is data residency. Self-hosting is how you get it.

Where self-hosted setups still leak

Running locally is necessary, not sufficient. The usual leaks:

• Cloud model providers. If the assistant calls an API, prompts leave. That may be fine — but it is a decision, not an accident, and should be made per workload.
• Telemetry. Crash reporting, usage analytics, update checks.
• Model and container pulls. Which model you fetched, and when, is itself signal.
• Backups. Off-device backup that is not encrypted client-side hands your data to whoever runs the bucket.
• Remote access. A relay that terminates TLS can read the traffic.

How deputyOS handles each

Provider keys stay local. They live in /etc/deputyos/secrets.env at mode 0600 and are never sent to api.deputyos.com. You pay providers directly; nothing is proxied or metered in between.

No telemetry. Not opt-out — absent.

Nothing is pulled at first boot. Everything is baked in, so there is no install traffic revealing what you run.

Backups are encrypted before they leave, with age. The storage provider holds ciphertext only. The corollary is real: lose the key and the backups are gone.

The tunnel is per-device and revocable, and the device chooses what to expose, so a compromised relay cannot wander the LAN.

Verify rather than trust

That list is a claim on a marketing page. Check it:

• Watch egress with tcpdump or your router and see what it actually contacts.
• Boot with the cable out and see whether it works.
• Read the source — it is Apache-2.0.
• Rebuild the image and compare hashes; builds are reproducible.

Verification beats a promise, which is the whole argument for self-hosting.

The trade

Local models are less capable than frontier models. The realistic arrangement is a local model for anything sensitive and a cloud API for work that genuinely needs frontier capability — a decision made per task rather than once for everything.