Written for the people who have to sign off rather than the people who have to be convinced. What the product touches, what it stores, what it can reach, and what is committed while LM-Kit One is in Business Preview.
Applies to LM-Kit One 2026.x releases · Last updated August 2026
There are two deployment modes and they have different disclosure properties. Anyone assessing this needs the difference stated, not blurred into one privacy claim.
Mode A
A local model does the reasoning as well as the processing. With external tools and optional telemetry disabled, and model weights already present, no document content, prompt, embedding or generated output leaves the host.
application or user → LM-Kit One / LM-Kit.NET → local model weights → local files, indexes, logs content stays on the host
Mode B
An external assistant supplies the conversation and calls governed MCP tools. Files, OCR, indexes and rendering stay local. The tool result is disclosed to that assistant, and that is the boundary to assess.
external assistant → governed MCP tool call → LM-Kit One → local files and processing ← selected tool result only
Mode B discloses whatever the tool returns. The defensible claim is that source documents stay local and administrators choose which derived results are shared. It is not a claim that nothing leaves the network, and we do not make that claim.
A private AI product that is reachable by default is not private. Every step that widens exposure is a decision an operator has to take deliberately.
Default
A fresh LM-Kit One install binds to the local machine. Reaching it from another host requires changing the network mode explicitly, and anonymous access over a network is refused rather than warned about.
Credentials
API keys are stored hashed, not in plain text, so the settings store does not contain a usable credential. Admin sessions and remember-me tokens are handled separately, and TOTP is available for the admin surface.
Isolation
MCP sessions and the files they can reach are bound to the authenticated owner, so one caller cannot read another owner's documents or collections through a shared endpoint.
Egress
Tools that reach the internet (web search, page reading, HTTP reads) are governed by an allowlist and an egress mode, so an operator decides what a model or agent may contact. Once model weights are present on the host, document processing, indexing, retrieval, inference and fine-tuning need no outbound connection at all, which is what makes air-gapped operation a supported mode rather than a claim. Model acquisition is the one step that needs network access, and it can be done once and then carried to the isolated host.
Everything the server writes resolves under one state directory, decided at startup and named in the startup log so you never have to guess which path is in use.
A machine-wide install never requires the service account to write inside the installation directory.
The weights are third-party artifacts running inside your perimeter, so their origin and licence are part of your supply chain, not ours alone.
Origin
Every catalog entry records where the weights come from and what they are, so a model inventory can be produced for review rather than reconstructed. You can also import your own weights and skip the catalog entirely.
Licence
An LM-Kit licence covers LM-Kit. Each open-weight model carries its own licence from its own publisher, and those terms govern how you may use that model. Check them for anything you put into production.
Fit
The console prices a model against the device before you commit to fetching it, so capacity problems surface at planning time rather than after a multi-gigabyte download.
LM-Kit One is in Business Preview ahead of general availability. Being precise about the boundary is more useful to an assessor than claiming there is none.
Committed
Support and response-time commitments apply during Preview, as they do for LM-Kit.NET. Preview participants also work directly with the engineering team.
Not yet
Interfaces can still change between Preview builds, and long-term-support versions arrive at general availability. Plan for some churn until then.
Artifacts
Windows installers are signed; the distributed macOS Preview package is signed, notarized and stapled, verified per release.
SHA-256 checksums, an SBOM, release notes and known issues are provided for every Preview build on request.
Write to security@lm-kit.com rather than opening a public issue, and give us a way to reach you for follow-up. We will confirm receipt, tell you whether we can reproduce it, and keep you informed until it is resolved. Please include the build you tested, the platform, and the steps to reproduce. This address is also published in security.txt.
Assessing LM-Kit
