Privacy and Security

Security & Privacy

Overview

This project is designed with a privacy-first architecture. All processing occurs entirely on the local machine. No data is ever sent to external cloud APIs.

Privacy Guarantees

Guarantee	Implementation
No cloud APIs	Local-only inference using Qwen3-VL-Embedding-2B
No data exfiltration	Files never leave the vault/ directory
Offline capable	Model weights are downloaded once and cached locally
Local vector store	ChromaDB runs as a PersistentClient on disk

Network Exposure

The application starts a local HTTP server at http://127.0.0.1:8000. It is not exposed to external networks by default.

CORS Policy

{
  "allow_origins": ["*"],
  "allow_credentials": true,
  "allow_methods": ["*"],
  "allow_headers": ["*"]
}

Current: Permissive (allow all origins) – intended for local development only.

Recommendation: Before any external exposure, restrict allow_origins to trusted domains.

File Access Controls

• /search is read-only and returns only metadata + scores.
• /file streams raw media from the vault/ directory.
• There is no authentication or access control layer.

Note: This application is intended for personal/local use. Do not expose to untrusted networks without adding authentication.

Model Integrity

The model weights are downloaded via huggingface_hub.snapshot_download from the official Qwen/Qwen3-VL-Embedding-2B repository. Ensure the Qwen/ directory is secured against tampering.

Related Components

• REST API Endpoints – Endpoint exposure and CORS configuration
• Environment Configuration – Trusted local paths
• Deployment Guide – Production security recommendations

---

Last Updated: 2026-06-17