Private Models and What Data Leaves Your Company

Before a company adds a model to support, search or drafting, private models decide which customer text may leave and which text stays on hardware you run. A hosted API fits public marketing and code help with no customer data. It is wrong for a contract, a medical note or a payment record. Install steps are in our guide to local AI hosting.

The usual mistake is one API key for every task. A public ticket, a page you will publish, a lookup with a customer’s email and a pasted contract share one endpoint. Nobody can then say what left the company. That is why private models send sensitive calls to a machine you control, with logs you can open.

CodeWiz is a development studio founded in 2023 by Dragan Plavšić in Banja Luka. We build the form, retrieval, redaction and the route. Sites and APIs sit on Hetzner, with Cloudflare in front of public pages. We say which machine processes each call, and we put private models on that path only where the rule says the text must stay.

Three places a prompt can go

A prompt goes to one of three places: the browser, your server, or a provider’s machines. The browser is the easy mistake. A page with the key in the front end sends the text from a laptop. Your server never sees it, so you cannot redact or log it. A contract pasted into a browser chat has already left.

Your server is where a decision can still be made. The application receives the text on a machine you control, often a Hetzner server. Cloudflare may sit in front of the public site. It must not cache the prompt, and it does not run the model. The server strips identifiers, searches your database, and chooses a route.

A hosted API processes the remaining text in the provider’s data centre. A model on a machine you administer does not. The provider can read whatever you send. Opting out of training does not move processing back onto your hardware. If the text must not leave the company, do not send it.

What a hosted provider typically logs

A hosted call is an HTTP request to someone else’s API. The body holds the instructions, the user text, attached passages and settings. The provider sees the account, the time, the model and the source address: the employee’s network, or your server.

Most providers keep an abuse-review log. Retention and training opt-outs differ by plan, so read the terms for the account you pay for. During the call the prompt is processed on their machines. A log may exist even when training is off, and you do not operate it. We do not call this certified. We record where the request is processed and what your application stores.

Your log is the copy you control. Store the task, the route, the user, the time and a request id. Do not store the raw prompt for a contract, a customer file, a medical note or a payment. A debug dump to a third-party tracker is another exit.

Redaction before a call

Redaction runs on your server, before a hosted call, not as a line in the system prompt. Emails, phone numbers, account ids and long digit strings become placeholders. The model can still say “the customer”. The real values stay in your database, in a map that never goes out with the request.

Use it for classification and for short drafts of text that is almost public. It does not make a contract safe. Clauses, prices and party names are the sensitive part, not only the email at the top. A card number typed as words will not match a digit rule.

• One server function, so every feature uses the same patterns.
• Keep the placeholder map in your database, with a short lifetime.
• Log that redaction ran, and how many placeholders it made, not the values.
• If the text is a payment credential or a medical note, refuse the hosted call.

Retrieval that stays in your database

Support lookup and drafts from your files are retrieval. The model did not memorise the business. RAG search runs in a database you host, where chunks, embeddings and permissions stay. Only selected passages enter the prompt. Do not upload the index, and do not send a whole contract because the window is large.

A hosted model receives whatever you attach, so a contract clause leaves even if the rest of the file stays on disk. A model you run can read the same passages without that hop. Chunking, search and permissions belong to our AI/ML integration work. The filter runs in your database before any model sees a row.

Which tasks stay on private models

One table covers the tasks people ask about. The three answers are deliberate: a hosted model is fine, keep the work on private models, or do not send the text to a model at all. “Keep on a private model” means the weights run on hardware you administer, not a hosted model with a privacy toggle.

Hosted classification needs the identifiers gone. A public draft can leave. A draft that quotes the customer stays, and so does support lookup. Those middle rows are why private models are in the design. A person still reads a contract answer. Medical text and card numbers do not go to any model. Send a status, such as “payment captured”.

The quality trade-off of private models

A smaller open-weight model is not the largest hosted model. On a long contract or a comparison of several documents it misses more. Teams that expect the same prose from a 7 to 14 billion parameter model paste the file into a hosted chat. That workaround deletes the reason private models were introduced.

Short tasks are realistic once retrieval has found the answer: a ticket label, a date, a draft from a template. Test them on your examples. Weights come from Ollama and the Hugging Face Hub. Serving is the hosting guide. Public work can use the hosted model. Sensitive work uses the smaller local model. Medical and payment text use neither.

When a hosted model is the right call

Use a hosted model for text that is public, or that never held customer data: marketing you will publish, a headline, a catalogue description, a question about a public library. The provider processes the prompt. That is fine when you would publish those words anyway.

Code help belongs here only with no private repository, environment file, customer dump or internal hostname in the prompt. Reject secret patterns on the server. A public error message is fine. A customer quote is not. You do not need private models for a public paragraph, but you need a gate for when it stops being public.

Contracts and customer files

Contracts, proposals and customer exports should not be processed on a provider’s machines. Prices, dates and clauses are the content, and a short summary can leak them. Keep that work on private models, on a server you control, and show the output to a person before it is sent.

A transcript or a complaint that names the buyer is not a public ticket. Your database finds the rows, and private models answer from those rows. The hosted API is not on that path. A clinical note does not belong in a prompt log. A card number does not belong in any prompt. Refuse the call.

A written data rule the team can follow

A slide that says “be careful with customer data” will not survive a Friday deploy. Write a rule the application enforces and the team can read. Start from the list below, and name your real tasks. In that rule, private models are a destination, not a slogan.

1. Name the task: classification, draft, support lookup, contract, or one you add later.
2. Public text, or generic text with no customer fields, may use a hosted model. Record the route.
3. Text that names a customer, an order, a contract party or an employee goes only to hardware you control.
4. Medical text, a payment credential, a password or a key is not sent to a model. Return a clear refusal.
5. Log the route (hosted, private or refused), the task, the user and the time. Do not log the forbidden text.
6. A new feature is a new task. Add a line before it ships.

Step 3 is where private models are mandatory. Step 4 is where even they are out of scope. The log lives on the server you run. It shows where a request went, without a second copy of a card number or a clinical note.

How We Work

The decision comes before the installation. We already publish how to host a model. Here the work is the rule and the routes, so private models are the path for the tasks that need them, and a hosted call stays available for the rest.

1. List the tasks and the fields each one reads: names, emails, orders, files, contracts, medical text, payment text.
2. Write the rule with you. Each task gets one of the three outcomes before a key is issued.
3. Draw the path. The browser talks only to your server, which calls a hosted API or a model you run. The prompt is not cached.
4. Build the gate for redaction, retrieval and refusal, and test it on synthetic examples.
5. Compare answers on tasks where both routes are allowed, before launch.
6. Hand over the log, the written rule and a way to change a task later.

Why CodeWiz

• Rule and system together. The form, the API, the database and the model route, so the rule is code rather than a PDF.
• Local AI and RAG. Retrieval stays in your database, and private models run where that database is reachable. The index is not copied to a provider.
• A stated place of processing. Founded in Banja Luka in 2023 by Dragan Plavšić. We host on Hetzner, with Cloudflare on the public site, and we name the machine or provider for each call.
• Open-source first. Open weights you can run yourself. The hosting guide covers the install. This article covers the choice.
• Fair and specific. A public draft does not need its own server. Premium work without premium prices, remote, for local and international clients.

Frequently Asked Questions

Do private models mean the text never leaves the building?

You choose the machine that processes the prompt. If you administer it, the provider does not get the text. A rented server abroad still counts. A third-party error tracker does not. Say where processing happens and what is logged.

Can we remove the names and then send a contract to a hosted model?

No. Prices, dates, liability and the description of the deal are why it is confidential. Redaction is for identifiers on text that may already leave. A contract stays on a model you run, and a person reviews the output first.

Are smaller local models good enough for support replies?

Often, when a retrieved passage already holds the short answer. They are weaker when several documents must be compared. Try both on real questions with synthetic names, and keep the hosted model for public tasks.

What should the application log?

Log the task, the route, the user, the time, and whether redaction or a refusal ran. Do not log the raw prompt for a contract, a customer file, a medical note or a payment. Keep that log with your other operational logs.

We already call a hosted API from the browser. What changes first?

Move the call to your server and remove the key from the front end. Then split the tasks: public drafts and generic code help stay hosted, support lookup and customer drafts go to a model you run, and medical or payment text is refused.

Decide what may leave

Bring the tasks you want a model to do. We mark each one hosted, private or refused, and build that into the code. Contact CodeWiz for the map. The wider practice is under our development services. In that work, private models keep the wrong text off someone else’s API.