Identity
Every caller is someone
API tokens are hashed at rest and scoped per caller. Operators are named accounts with roles, two-factor authentication, and single sign-on over OIDC.
LM-Kit One · Security
Security by architecture, not by prompt.
Seven boundaries, each controlled on its own: who calls, what they may reach, who administers, what is recorded, and what ever leaves.
Seven boundaries, separately controlled.
Private AI is not an API key in front of an inference endpoint. Each boundary below is its own decision, with its own controls.
Network
Loopback until you decide
A fresh install listens on the local machine only. Network exposure is an explicit change, and anonymous network access is refused rather than warned about.
Capability
Tools are policy, not prompts
What an agent or assistant may execute is an operator decision enforced server-side, never an instruction a clever prompt can argue with.
Isolation
Data stays with its owner
Sessions, files and collections are bound to the authenticated owner, so one caller cannot read another's documents.
Administration
A separate plane
Administration is its own authenticated surface with role separation, not a privileged corner of the data API. Secret settings are encrypted at rest, so a copied configuration file reveals no credential.
Audit
Actions carry their actor
Requests are attributed, administrative changes are recorded with who made them, and history is inspectable from the console.
Egress
Outbound is an allowlist
Tools that reach the internet are governed by policy rather than assumed. Once models are present, documents, indexing, retrieval, training and inference need no outbound connection at all.
The operating rule: LM-Kit One runs fully locally and can operate completely air-gapped. External access is explicit and controlled. For the jurisdictional half of the story, see Sovereignty & EU.
Claims you can verify yourself.
For a closed-source server, trust comes from what you can check, not what we assert.
Nothing to activate
No account, no license check
The free tier has no activation, no account and no runtime license check. There is no phone-home a licensing layer could hide in.
Telemetry
Export stays off until enabled
Metrics live on the server for its own console. Exporting them anywhere is a setting an operator turns on, not a default to discover.
Air gap
Deny-all is a supported mode
Pre-provision models, close outbound entirely, and operate. The documentation and API reference travel inside the server.
Releases
Signed, verifiable artifacts
Windows installers are Authenticode-signed and the macOS package is notarized and stapled. SHA-256 checksums, an SBOM and release notes are available per release.
Watch it
The traffic tells the truth
Run it behind your own firewall rules and observe: outside the model downloads you trigger and the egress you allow, there is nothing to see.
Reporting
A real disclosure path
Vulnerability reporting and release evidence are documented in the Trust Center, written for the people who sign off.
LM-Kit One