Local does not automatically mean secure
A private deployment can keep prompts and documents inside the company boundary. It also introduces new assets: model weights, system prompts, knowledge indexes, chat history, APIs and service accounts. Each needs ownership, access rules, backup and monitoring.
Separate model access from document access
Permission to use an assistant must not imply permission to every indexed document. A RAG layer should preserve source permissions or apply an equivalent authorization model at retrieval time. Log which sources were retrieved and which policies were applied.
Design for AI-specific abuse
Prompt injection can arrive through a user message or a document. Controls should separate trusted instructions from untrusted content, restrict tools, validate sensitive operations and filter outputs. The interface should cite sources and allow the model to say that evidence is insufficient.
Treat logs as sensitive data
Conversation logs help investigation and quality review, but they may contain confidential or personal information. Define retention, masking, administrator access and deletion before production launch.
A practical baseline
- central authentication and roles;
- encrypted transport and storage;
- separated model, retrieval and integration zones;
- controlled outbound connectivity;
- audit of administrative and sensitive actions;
- permission checks on every retrieval;
- tests for leakage, injection and unsafe actions.
Private hosting provides control. Security comes from how that control is engineered and operated.