"Your data stays inside" is the easiest sentence in this market to write and the hardest to verify. It is not dishonest. It is unfinished, because it does not say which data, which part of the system, or inside what.
The ten-minute test
Draw the complete path of a single request, end to end, and do not skip a stage because it seems obvious.
User, application, AI service, model, logs, storage, backup, update channel, support access. Then mark every arrow that leaves the building. The count is the answer, and it is usually higher than expected.
The six arrows that cross without a decision
- Telemetry and crash reporting, switched on by a default in a component nobody chose
- The automatic update channel, which is an outbound connection with write access to the system
- Backups, which frequently land somewhere with a different security posture than the primary
- A remote support tool, dormant until the day somebody needs it and then fully privileged
- A retrieval or embedding service that is hosted even though the model is local
- Logs, which contain prompts, and prompts contain the document
A deployment can satisfy "the model runs locally" while five of those six arrows point outwards.
What a documented cloud service looks like, for comparison
A cloud provider that documents its flows properly makes this exercise easier, not harder. Microsoft's documentation for models sold by Azure states plainly that “The models are stateless: no prompts or completions are stored in the model”, and separately that prompts and completions may be stored for abuse monitoring, where “Human reviewers assessing potential abuse can access prompts and completions data only when that data has already been flagged by the abuse monitoring system”.
Two arrows, both documented, both conditional. That is what a precise claim reads like. A local deployment should be held to the same standard rather than a lower one.
Ask the supplier to draw the diagram. If the answer is a sentence rather than a diagram, the sentence has not been tested.
What staying inside does not protect
Even with every arrow pointing inwards, information can still leave through the front door. OWASP's 2025 Top 10 for LLM applications lists sensitive information disclosure as LLM02 and prompt injection as LLM01, and adds vector and embedding weaknesses as LLM08.
Each of those is a route from an internal document to the wrong reader, and none of them cares where the model is hosted. Excessive user permissions, a compromised laptop, a malicious PDF and an unprotected log all survive the move indoors.
The version of the claim worth making
The useful formulation is narrower than the slogan, and it can be tested: inference traffic and model processing remain inside the organisation's controlled network boundary, with no outbound connection required to answer a request.
That states what is controlled and implies what is not. It is worth more to a security officer than an absolute promise, because it is one they can verify.
With Bastion
What Bastion changes
Bastion is a private AI system delivered as one sealed appliance that runs inside your building. One monthly fee covers the hardware, the model, the hardened operating system and support, and nothing your team types leaves the building.
Bastion answers with no outbound internet connection required, so the inference arrow does not cross the perimeter. Updates are signed and installed deliberately rather than pulled automatically, which keeps the update channel a decision rather than a default.
The arrows that remain are the customer's: who may use the system, which documents it may read, where the logs go and who holds the backups. This article exists so those are decided rather than assumed.
Questions this article answers
- What does "your data stays inside" actually mean?
- Only what the architecture says it means. The testable version is narrower: inference traffic and model processing remain inside the organisation's controlled network boundary, with no outbound connection required to answer a request.
- Which parts of a local AI system still send data out?
- Commonly six: telemetry and crash reporting, the automatic update channel, backups, a remote support tool, a hosted retrieval or embedding service, and logs, which contain prompts, and prompts contain the document.
- Does local processing prevent data leaks?
- No. OWASP's 2025 list puts sensitive information disclosure at LLM02 and vector and embedding weaknesses at LLM08. Excessive permissions, a compromised laptop, a malicious document and an unprotected log all survive the move indoors.
On the record
- 1
Microsoft Learn
Data, privacy, and security for Foundry Models sold by Azure in Microsoft Foundryread 2026-09-22
- 2
Read next
- What is private AI, and when does an organisation actually need it?Private AI is not a different kind of model. It is a different answer to one question: who controls the environment where the data is processed. What that answer changes, what it leaves untouched, and the five questions that settle it.Read the article
- AI security starts at the network and does not end thereA firewall is layer one of seven. Identity, authorisation, data, application, model and operations are the other six, and an on-premise deployment only improves one and a half of them.Read the article