# Privacy and egress The one sentence: **when a request runs on a Circle-mate's GPU, that person's machine sees your prompt.** Everything below is the detail behind that sentence, including how to turn it off. This page describes the running system during closed beta. The formal policy is at [/privacy](/privacy); this is the operator's-eye version. ## What leaves your machine, and when Saylek serves a request locally when it can. When your own machine **cannot** serve the model you asked for, and a Host in one of your Circles can, the request goes to that Host automatically. You do not switch this on. Joining a Circle is what enables it. What travels: - Your **prompt**, and everything your tool put in the context window with it. For a coding agent that routinely means file contents, diffs, stack traces, and anything else it read on the way to the task. - The **completion** comes back the same way. The Host's machine handles both in the clear. It has to: that is how it computes the answer. The Host is a peer running `saylek host`, not an opaque cloud endpoint, but it is still a different person's computer. ### It does not go straight there Your request reaches that Host **by way of our registry**, which routes it. So your prompt is on Saylek's server too, not only on the Host's machine. We do not read it and we do not train on it, but it would be wrong to let you picture a direct machine-to-machine hop. How long it can sit there is the least tidy fact on this page: the routing queue is trimmed **by count** (about 10,000 entries) and **never by age**. A busy queue displaces your prompt in moments. A quiet one can hold it indefinitely, because nothing deletes it for being old. The [privacy notice](/privacy) states this in the same terms. ### What the Host learns about you A **key fingerprint**, not your name or email. It is **stable across requests**, so a Host can tell that many requests came from the same member. They cannot tell *which* member from that alone: pseudonymous, not anonymous. The registry, which does the routing, does know which member you are. ### What is kept afterwards Nothing on a machine is deleted automatically. Receipts and activity logs stay until someone removes them by hand (`saylek wipe`), on your machine and on the Host's alike. Receipts hold **hashes, not text**, so they are not a transcript of what you typed. The full inventory is in the [privacy notice](/privacy). ## The boundary is social, not cryptographic Saylek's answer to "who can see my requests" is **membership**, not encryption: - Consumption routes to Hosts **in your Circles only**. A stranger's Host is never a serving candidate for you, and you are never one for them. - There is no setting that makes a Circle-mate unable to see what they serve. That is not a missing feature, it is the model. The honest rule of thumb: **do not send a Circle anything you would not hand to its members directly.** It is the same judgement you already make about who you let watch your screen. Be precise about who a Circle-mate can be. On an **invite-only** Circle (the default), members are admitted by the Circle's owner, or by an owner or admin when an organization owns it, so unless you own the Circle someone else chose them. A Circle can also be set to **open-join**, in which case people join without an invite and may be strangers to you. See [Circles and membership](/docs/circles) for how to tell which kind you are in. ## Turning egress off Two controls, and both can only force a request to stay local. Neither can ever force a request out. ### Persistent: local-only mode Set in `~/.saylek/config.toml`: ```toml [federation] local_only = true ``` With this on, **Saylek will not route your request to a Circle-mate.** It serves locally or it fails. Be precise about the scope, in two directions. It stops your prompts, uploads, and completions going to another member. Saylek still talks to our servers for the ordinary running of your account, such as signing in, checking Circle memberships, and looking for updates. Local-only is a content control, not an airgap. It also does **not** override an upstream **you** configured yourself. If you have registered a proxy upstream in `upstreams.toml` and you call a model that resolves to it, the request is forwarded there, local-only or not. That is deliberate in the sense that you set it up, but it is not what "local-only" sounds like, so: local-only governs *Saylek's* routing, not a destination you added by hand. If you want nothing forwarded anywhere, turn the upstream off as well. Be clear about the trade: **if your machine has no GPU capable of serving the model, every such request now fails.** That is the honest semantics, not a bug. Local-only means local, including when local cannot answer. ### Per request: a header For a single call, without changing your config: ```bash curl http://127.0.0.1:8443/v1/chat/completions \ -H "x-saylek-local-only: 1" \ -H "Content-Type: application/json" \ -d '{"model": "MODEL_ID", "messages": [{"role": "user", "content": "hello"}]}' ``` The header forces that one request local. It cannot override persistent local-only mode to force egress. ### Leaving withdraws it Hold **no live Circle membership** and the system fails closed to local. Leaving your last Circle withdraws the standing default. One honest caveat about timing: your machine caches what it knows about your memberships for a short period, on the order of minutes, rather than re-checking on every single request. So immediately after you leave, a request can still be sent before your machine has caught up. If you want the change to take effect the instant you make it rather than shortly afterwards, set local-only as well, which takes effect at once because it is read on your side. ## What receipts prove Every served call mints a signed receipt. A Host-served receipt names the serving node and key fingerprint, co-signed by both sides. Verifying is offline, and the command depends on whether you want one receipt or all of them: ```bash saylek receipt show --verify # one receipt, with the signature check appended saylek receipt verify --all # walk every receipt under ~/.saylek/receipts/ ``` `saylek receipt verify` on its own does nothing on purpose: batch verification is the kind of thing you should have to ask for explicitly, so it refuses without `--all`. | Receipts prove | Receipts do not prove | |---|---| | This request ran on this Host, on this model, at this time | That the content stayed private from that Host | | Both parties attest to it | Anything about confidentiality | A verified receipt means "this is who ran it". It does not mean "this was private". The Host signing your receipt is the same Host that saw your prompt. `saylek receipt show ` says exactly this in plain language before it prints the audit body. ## What we do not claim - **Not encrypted from the Host.** Federated consumption is readable by the serving Host. It is TLS-encrypted *in transit*, which protects it from anyone in between, not from the people it is travelling to. - **Not confidential compute.** Making a Host *unable* to read what it serves (enclaves, content-blinding) is a V-Next direction under assessment. It is not in the closed beta, and nothing here depends on it. - **Not "your prompt is never written to disk anywhere."** Saylek has an opt-in debugging setting (`[debug] traces = true`) that writes prompts and replies to a plaintext file so an operator can see what their own machine is doing. It is **off by default**, and as the code stands a Circle-mate's request does not reach that writer. But that is because of how the request happens to be shaped, not because a rule stops it. We are turning that into an actual rule. Until then we would rather state the shape of it than round it up to a guarantee. If you point Saylek at a different registry with an `http://` address it will use an **unencrypted** connection and will not warn you. Do not do that outside a trusted local network. ## Next steps - [Circles and membership](/docs/circles): who ends up in your Circle, and how to leave. - [Concepts](/docs/concepts): where this sits in the whole model. - [/privacy](/privacy): the formal policy page.