Where Your Data Lives

Two Questions Wearing One Coat

The hosting question arrives sounding like one question — where does this run? — and it is two. Where the thinking happens and where the data rests are separate decisions with separate consequences, and each can be changed without touching the other. Almost every conversation about self-hosting an assistant goes wrong at exactly this point, because the interesting-sounding question is the less important one.

Inference Is the Swappable Part

The model is the part that takes a prompt and works out what should happen next. It can run on the laptop, on a machine at home, or behind an API — a capability choice, and a reversible one. The frontier moves every few months, and a system built so that the model is a supplier rather than a foundation gets to take that upgrade without a migration.

What the model does not do is hold your world. The vault does: the notes, the decisions, the task graph, the pointers to credentials, the git history of every change to all of it. That is the asset, and it sits wherever you put it, unchanged by which model you point at it. Files are memory is why that separation is possible at all.

Custody Is the Axis That Matters

Custody is three questions: where the data rests, who can read it there, and what leaves the machine and when. Answer those and the hosting question has answered itself. Here is the honest cost at each point on the line.

• The laptop you work on. Full custody, nothing to administer, and everything to hand. The cost is availability: close the lid and nothing is running. Keep-awake utilities exist and they are a patch, not a plan — a machine you carry is a machine that travels, sleeps, and runs out of battery. Scheduled work does not survive it.
• A machine you own that stays on. A small computer at home, always awake, doing the overnight work. Custody is identical to the laptop and availability is real. The cost is that you are now an administrator: updates, backups, a disk that will eventually fail, and physical access for everyone else who lives there.
• A rented server. Availability without owning hardware, at the price of shared custody. Someone else runs the hypervisor and can image the disk. Encryption at rest helps in proportion to who holds the key — and the working set is plaintext while the work is happening, which is whenever the work is happening.
• Whoever runs the model. Every hosted prompt sends something. That is a per-prompt decision, not a hosting decision, and it is the one most people never make deliberately. Which provider it is matters far less than what you chose to put in the prompt. Read the retention and training terms once, properly, and then decide what you are willing to send.

The Decision, Phrased Correctly

Not “local or cloud” — that framing forces one answer for everything and so gets answered by taste. The usable version is: what must never leave this machine, and what is fine to send? The answer is never uniform. Most of a vault is dull. A narrow slice of it is not, and that slice deserves a rule rather than a habit.

That rule is what confidentiality tiers are for. Every team member’s charter declares what it may put in a summary, so the constraint sits in writing next to the thing it constrains, rather than in your head at the moment you are busy. Secrets themselves never enter the vault at all — the vault holds a pointer to the drawer, not the key. Credentials and confidentiality is the mechanism.

Getting this right buys something better than privacy. It buys the ability to change your mind cheaply. A system where custody and inference are one decision has to be rebuilt to move either. A system where they are two lets you swap the model on a Tuesday and move the vault to a machine at home on a Wednesday, and neither move touches the other.

The model is a supplier. The vault is yours. Decide about the vault first.

#custody · #hosting · #privacy