Security and privacy: what we do, and what we don't

Distributed inference raises two fair questions: what happens to a customer's prompt, and what happens to a host's machine. Here is the current answer to both, including the parts that are still work in progress.

If you send us prompts

• Nothing is retained. A prompt lives in memory while the job runs. The job record drops its messages the moment it settles; what remains is counts — tokens, cost, model, timestamp — with no text.
• Nothing is trained on. Not by us, not by hosts. There is no pipeline that could; the text is gone.
• EU by default. The control plane runs in the EU, on our own hardware, under Belgian law. No CLOUD Act obligation reaches it through a US parent, because there isn't one.

If you host

• You run pinned artifacts only. A specific engine release and specific model files, each verified against a SHA-256 while downloading and again at every load. There is no mechanism for the server to hand your machine arbitrary code or an arbitrary URL.
• The engine is local. It binds 127.0.0.1 and is not reachable from outside your machine. mahout needs no inbound port at all.
• A prompt is data. Jobs carry text to a model, never instructions to your operating system. No tool execution happens host-side, ever.
• You keep control. mahout auto-pauses while you are using the machine, mahout pause stops it taking new work, and mahout uninstall prints a deletion plan before removing anything.

What is not done yet

The engine today runs as an unprivileged child process, not inside a sandbox with a syscall filter. Hardening that — seccomp and Landlock on Linux, no-egress containers for the vLLM tier — is scheduled, and we would rather say so plainly than imply a boundary that isn't there yet. The technical specification describes both the current state and the target.

Verify rather than trust

mahout is open source and its releases are checksummed. You can read what it does before you run it, and check that what you downloaded is what we published.