Privacy you can prove, not privacy you're promised.

Every prompt is a disclosure

It is easy to forget what actually happens when you use a hosted model. You type a question, you paste in a file, you attach a document — and all of it leaves your machine. To be answered, your input has to travel across the network to a computer that belongs to someone else, where it is read, processed, and very often written down. The answer that comes back feels like a private conversation. It was not. It was a transfer.

We don't think of it as a transfer because the interface hides the distance. The same box that runs a search, drafts an email, or summarizes a contract sits one keystroke away, and the prompt vanishes the moment you press enter. But behind that box, your words crossed the wire. The contract clause, the patient note, the unreleased plan, the customer record — each one was handed to infrastructure you do not own and cannot inspect.

This is the first fact everything else rests on, and the one most easily missed: to run a rented model, you ship your data to it. There is no version of using a hosted model where the input stays home. The disclosure is not a risk that might happen if something goes wrong. The disclosure is the normal, designed-in way the service works.

A policy is a promise

Once your data has crossed the wire, your protection is no longer technical — it is a promise. The provider's privacy policy tells you what they intend to do: how long they keep your input, whether anyone looks at it, whether it may be used to improve their models. These are commitments, and many providers take them seriously. But a commitment is not a control. It is a description of behavior you are trusting someone else to perform, on a machine you cannot see.

The fine print rewards careful reading. Inputs are often retained for a window of time, commonly for safety or abuse checks. Whether your data is used to train future versions of a model differs by plan, by contract, and by whether you have opted out — the generous defaults that apply to a paid account are frequently not the defaults of a free one. The strongest assurances usually live in a separate negotiated agreement, not in the terms everyone clicks past. The protection you actually have is the protection you arranged, not the protection you assumed.

And a promise can change. Terms get revised. Companies are acquired, restructured, or run into trouble. A setting you relied on quietly moves. None of this requires bad faith — it only requires that the thing protecting your data is a document rather than a boundary. You are trusting not just today's policy but every future version of it, written by people you will never meet.

The one-way door

There is a particular reason disclosure deserves more caution than it usually gets: it does not reverse. The moment your input crosses the wire, you no longer hold the only copy. It has been received, and very likely logged. You cannot reach across the network and un-send it. Whatever happens next — kept, copied, examined, exposed — is now outside your hands. Sent is sent.

Deletion does not undo this, because deletion is also just a promise. When a provider agrees to remove your data, what you have is a contractual commitment that it will be erased from the systems they know about, on a schedule they control. That is a reasonable thing to ask for and a worthwhile thing to get. But it is a pledge to act, not a physical guarantee, and it cannot account for copies in backups, in logs, in the records of partners, or anywhere the data was carried that no one is tracking.

Other people's promises age into other people's problems. Data that has left your control can later be sought in a dispute, swept up in a breach of a system you never chose, or exposed by a mistake you will never witness. The risk is not loud or immediate. It simply waits. The only input that cannot be retained, leaked, demanded, or regretted is the one that never crossed the wire in the first place.

Some work simply can't leave

For a great deal of valuable work, this is not a matter of preference — the rented path is off-limits before the question of quality even comes up. Whole categories of data carry rules about where they are allowed to go. Regulated information in health, finance, and other sensitive fields; records that must stay within a particular region or border; material a client handed over under a duty of confidentiality; the proprietary internals a company guards as its own. For all of these, sending the data to an outside model can itself be the violation.

The constraint is not really about secrecy; it is about jurisdiction and obligation. Rules about where data may go treat handing it to a third party, or moving it across a border, as an act with consequences in its own right — independent of whether anything bad ever happens to it afterward. A professional who owes a client confidentiality cannot quietly route that client's matter through a service they do not control. The duty does not pause because a tool would be convenient.

So the most important work is often exactly the work that cannot take the rented road. The teams doing it are not refusing useful tools out of caution. They are bound by obligations the tool's design cannot satisfy. For them, the question was never which hosted model is best. It is how to get real help on data that is not allowed to leave the building.

Privacy as a property, not a policy

There is a way to change the question entirely, and it is structural. When the model runs on hardware you control — on your own machine, your own server, inside your own network — the input never has to cross the wire to be answered. The computation comes to the data instead of the data going to the computation. Nothing is sent, so there is nothing on the outside to retain, to train on, to be demanded, or to be lost.

This turns confidentiality from a policy into a property. A policy is a promise about behavior you are trusting someone to honor. A property is a fact about how the system is built — true whether or not anyone is watching, whether or not the terms change, whether or not the provider you chose is still standing next year. The boundary stops being a clause in an agreement and becomes a physical reality: the data stayed on the machine because there was no path off it.

Open weights are what make this ownable. A model whose weights you can hold runs on your hardware, on your terms, with no call home required to function — so the boundary is yours to keep. You are no longer renting an answer and shipping your data to collect it. You are running the model where the data already lives, and the question of who else saw it simply never arises.

Not secrecy — control

The goal was never to cut the wire — it is to decide what crosses it: keep the sensitive work home, and send out only what is safe to send. Most of what an organization does is meant to be shared, published, and connected to the wider world, and pulling everything inward would be its own kind of failure. Control is not the same as secrecy, and it never required it.

Sovereignty is control over that boundary, not a refusal to use it. You still reach for hosted models and outside services when the data is public, low-stakes, or already meant to leave — there is no virtue in self-hosting a task that was never sensitive in the first place. What changes is that the decision becomes deliberate. Each piece of work gets routed by what it actually is, instead of everything taking the same road off your machine by default.

Drawn this way, the line is not a wall; it is a checkpoint you operate. The confidential matter stays inside, grounded on data you hold. The harmless query goes out and comes back. Knowing the difference, and building so the difference is enforced rather than hoped for, is what control looks like in practice.

Sovereignty is an architecture discipline

Stated as a principle, this is easy to nod along to. The hard part is building so it holds under pressure, when a deadline makes the convenient path tempting and the boundary depends on a habit instead of a design. Sovereignty is not a vow to be careful. It is an architecture: a system arranged so that sensitive work physically cannot take the route off the machine, and only the safe traffic ever can.

In practice that is a set of concrete choices. Run the routine and the confidential work on models you own, where the input never leaves. Ground answers on data you control rather than shipping that data out to be read elsewhere. Classify what is sensitive and what is not, and route each request accordingly — local for what must stay, outside for what is free to go — so the safe default is the private one and crossing the wire is a decision someone made on purpose. Built this way, confidentiality is a property of the system, not a discipline you have to remember.

This is the same kind of engineering that holds up everywhere else that matters. You don't protect a sensitive system by asking everyone to be careful with it; you build it so the careless path is closed. Privacy earns the same treatment. When the structure enforces the boundary, you are no longer one tired afternoon away from a disclosure you can't take back.

Become the one they can trust with it

The valuable skill here is not a strong opinion about privacy. It is the ability to build the boundary into the system — to decide what runs local and what is safe to send, to stand up models on hardware you control, to ground them on data that never leaves, and to wire the routing so the private path is the default and the public one is a deliberate exception. That capability does not expire when a model is replaced or a provider changes its terms. It is the durable part.

As more work falls under rules about where data may go, and more organizations learn the hard way what a promise is worth, the people who can make confidentiality a property rather than a hope will be the ones trusted with the work that matters most. Not because they kept secrets, but because they built systems where the sensitive data was never exposed to begin with. You can become that person — the one they hand the work that isn't allowed to leave.