Data and security
What happens to your data, and what runs on your machines
Written for the people who have to sign off: data protection officers and IT leads. It describes what the software does today, including what it does not do. It comes from our own reading of the code; nobody outside has audited it yet.
Who can read what
A pool is the boundary: a pool's model runs only on that pool's machines. Put only machines you trust in a pool, and run the coordinator yourself if prompts must stay in-house.
| Where | What it can read |
|---|---|
| The coordinator | Prompts and replies pass through its memory on every request. Chats in the web interface are stored on it as plain text until their owner deletes them. Chats through the API are not stored. |
| The machine with the first layers | The prompt as text, because it turns the prompt into tokens. |
| Machines in the middle | Intermediate numbers, not text. We do not claim these numbers are anonymous, so treat them as sensitive. |
| The machine with the last layers | The reply, because it picks each of its words. |
| One machine alone | Everything, when it holds the whole model. |
| The relay | Runs on the coordinator and carries traffic between machines that cannot reach each other. It passes that traffic on without decoding it, but the traffic is not encrypted there. |
- Stored chats. The interface and API show a chat only to its owner, admins included. Whoever can open the database or a backup can read them.
- Logs. We do not write prompts or replies to logs by design. A machine's error output reaches its log unfiltered, so this is a design rule, not a guarantee.
- Usage statistics. Time, model, machine, token counts and latency, without text or user, kept for 7 days by default.
How it travels
- Browser to coordinator. HTTPS where the coordinator is deployed behind TLS, as ours is. Without it, the traffic is plain HTTP, so deploy it with TLS.
- Directly between machines. SilentSwarm adds no encryption of its own today. Direct links are plain TCP, so use a network you trust or the mesh.
- Over the mesh. A WireGuard mesh, using Tailscale's client and a self-hosted Headscale server, encrypts this traffic when it is up. It is best effort: if it fails, traffic falls back to the relay.
What is stored, and for how long
- Training data is kept as plain files on the coordinator. The machines in a training run fetch it from there, or from Hugging Face where a dataset is referenced by name.
- Models are kept on the coordinator and on the machines that serve them. They outlive the deletion of the data they were trained on.
- No encryption at rest. SilentSwarm does not encrypt what it stores, so use disk encryption. Backups are yours to make, and they keep what was later deleted.
- No time limit on chats, the audit log, inquiries, training data or models.
- Deleting. Owners delete their own chats. An admin deletes an account, which ends its access but does not remove all of its data: training data, models, audit entries and inquiries stay until deleted separately.
What runs on your machines
- No sandbox. The worker is an ordinary process with the rights of whoever installed it. Installed as root, it runs as root, so install it as an ordinary user.
- Whoever controls the coordinator controls its workers. An update makes a worker download a script from the coordinator and run it with the worker's rights. A checksum from that same coordinator shows that the code arrived intact, not who wrote it. So run your own coordinator, or trust the one you join.
- What it installs. The directory
~/.silent-swarmand a start-at-boot entry, as a service or a cron line, unless you pass--no-autostart. Models go to the Hugging Face cache. - On the network. It connects out to the coordinator. While serving, it also listens on its pipeline ports, on all interfaces unless
SWARM_ZMQ_BIND_HOSTpins them to one. The firewall changes only if you pass--allow-from. - What it reports. Host name, processor, memory, free disk, GPUs, IP addresses, load, temperature and power, its logs, and the name, ID and memory use of other processes on its GPUs.
- Removing it.
fellow purgeremoves the directory, the start-at-boot entry and the firewall rules it added. The Hugging Face cache stays.
Accounts and access
- Credentials. Passwords are stored as scrypt hashes, sessions and API tokens as SHA-256 hashes. Two-factor sign-in with an authenticator app is available, and optional.
- API tokens carry scopes: read, operate and admin.
- Audit log. Security-relevant actions are recorded with address and IP, for admins to read. It offers no way to edit entries, but it is not tamper-proof against someone with database access.
- Reviewing the source. The source code is not public. A source review under NDA is available on request.
- Default deny. An API route that is not explicitly classified is refused.
- Installing. The installer checks the source archive against a checksum before it runs anything. On our coordinator, installer and source need a join token or a machine's credential.
Who else is involved
- NexPatch. Reading the code, we found no call to us from a coordinator you run yourself. That is a code review, not a capture of the traffic.
- Hugging Face. Model and dataset downloads, and look-ups of their names and sizes.
- Tailscale. The mesh client's download and the map of its public relays. Mesh traffic can pass those relays when machines have no direct path. We have not captured the traffic to rule out other contact.
- Package indexes. Python packages during installation.
- Your browser. The web interface loads nothing from third parties.
- What you configure. Your mail server, alert webhooks, and addresses you import data from.
Data protection
- On a coordinator you run, what it stores stays with you, and so does responsibility for it.
- On a coordinator we run, NexPatch AI UG stores what this page describes. Our privacy policy has the details.
- Questions for your review? Ask us during the evaluation, including about a data processing agreement.
What is not built yet
- A sandbox for the worker.
- Encryption of its own between machines.
- Encryption at rest.
- Time limits on stored chats and on the audit log.
- Self-service account deletion and data export.
- An external audit or certification, such as BSI C5 or ISO 27001.
Found something?
Report a vulnerability to security@nexpatch.ai. Everything else goes to info@nexpatch.ai.