The short version
If you download your AI, your documents never reach us. Not encrypted, not briefly, not in a queue somewhere — they are read, indexed and answered on your own computer, and the finished AI has no dependency on us at all.
That is a claim about architecture, not about conduct. The difference matters. A company that promises to handle your data carefully is asking you to trust its staff, its contracts, its breach response and its future owners. A company that never receives your data is asking you to trust one thing: that the software does what it says. And unlike the first list, that one is checkable.
The rest of this page is how to check it.
Two tiers, two threat models
Nearly every question on this page has a different answer depending on which version you chose, so it is worth settling that first.
| Download | Hosted | |
|---|---|---|
| Your documents live | On your disk | On our servers |
| The knowledge base lives | On your disk | On our servers |
| The model runs | On your machine | On our servers |
| Conversations are stored | On your machine | On our servers |
| Reachable from | Your machine, and your network if you choose | Anywhere with the address and a key |
| Works if Ngaro shuts down | Yes, indefinitely | No — it would need migrating |
| We could be compelled to hand it over | No. We do not have it | Yes, in principle |
We are deliberately blunt about that last row. If the possibility of a legal demand, a compromised server or a future change of ownership is part of your threat model, choose download. That is what it is for, and we would rather say so here than have you discover it later.
What "0 bytes leave your machine" means
On the download tier, once your AI is installed, the documents you have given it and the conversations you have with it stay on your disk. Three separate things make that true, and it is worth separating them because they fail in different ways.
- The model is local. It is packaged inside the installer — that is why the download is measured in gigabytes rather than megabytes. There is no inference request going anywhere, because the thing doing the inference is on your machine.
- The index is local. Your knowledge base is a searchable index built on your disk and consulted at the moment you ask a question. It is not synchronised, mirrored or backed up to us.
- Outbound traffic is blocked, not merely unused. With the internet toggle off, the app blocks outbound network traffic from the model at the system level. See the next section — this is the part people are most right to be sceptical about.
What this does not mean: it is not a claim that the application never contacts us for anything at all. Licence and account checks, update checks and crash reporting are separate from your documents, and they are described in the privacy policy rather than hidden inside a slogan here.
The internet toggle
Your AI has a single switch for internet access. It is off by default. Leave it off and your AI is sealed; flip it on when you need live information.
The important design decision is where that switch lives. It is not a line in the model's instructions telling it not to go online, and it is not a setting the model can read. It is enforced outside the model, by the application, at the network layer. The ability to reach the internet is simply not granted to it.
That distinction is the whole thing. A rule written into a prompt is a request, and language models can be argued out of requests — by a cleverly worded document, by an instruction hidden in a PDF you fed it, or by accident. A capability that was never granted cannot be argued with, because there is nothing there to persuade.
How to check it yourself. You do not have to take this on faith. With the toggle off, run a packet capture on your own machine — Wireshark, Little Snitch, or the firewall logs your operating system already keeps — and ask your AI a question. There should be no outbound connection from the model process. If you find one, we want to know — see reporting a vulnerability below.
The one part that isn't local
Here is the caveat we would rather you heard from us.
The finished AI runs entirely on your machine. The process of building it does not. The onboarding agent that interviews you in plain English — the conversation where you describe what you want your AI to do — runs on a third-party model, currently Anthropic or OpenAI. Building your AI also involves our servers for the steps you approve and pay credits for.
So during the build, what leaves your machine is your side of that conversation: the description of the job, the names and structure of what you want it to know, and the settings you choose. What you are describing goes further than nothing.
Once the installer is built and downloaded, this stops applying entirely. From that moment the third-party model is out of the picture and so are we.
What we ship, and how to verify it
Nothing in the delivered product is proprietary. Every component is open source and independently verifiable, which means you are never trusting a black box — or us — with anything you could check yourself.
| Component | What it does | Why it matters here |
|---|---|---|
| Ollama | Runs the model on your machine | The inference engine is local and inspectable |
| ChromaDB | Stores your knowledge base as a searchable index | Your documents sit in a database on your disk, in a format you can open |
| nomic-embed-text | Turns your documents into something searchable | Open-weight, so the indexing step is not a mystery either |
| LangChain | Wires retrieval to the model | The path from your question to your document is standard and readable |
| SearXNG | Searches the web, when you turn the toggle on | A privacy-respecting metasearch layer rather than a direct search-engine account |
The models are open weight too — Qwen3 8B, Qwen3 32B, Llama 4 Scout, DeepSeek distilled and GLM-5.1. Every one can be downloaded, inspected and run by anyone, independently of us. If you want to satisfy yourself that the model on your disk is the model we said it was, you can compare it against the public release.
The hosted tier
If you host with us, your documents, your knowledge base and your conversations live on our servers instead of your disk. We are upfront about this because it genuinely changes what you are trusting.
Our servers are with Hetzner, in Germany and Finland. Payments go through Stripe and we never see card numbers. Contact-form and waitlist entries sit with Supabase in Sydney. The full list, and what each one is for, is in the privacy policy.
What does not change on the hosted tier: we still do not train on your documents, and we still do not read them for any purpose other than answering your own questions with them.
The API key
A finished Ngaro AI can hand out a key against an OpenAI-compatible endpoint, so
your other software can talk to it. On the download tier that endpoint is local —
http://localhost:8420/v1 — which means automation running on your own
network never touches the internet at all. On the hosted tier it is reachable from
anywhere that has the address and the key.
Every key is scoped deliberately narrowly: it reaches one AI and one only, it is rate limited, it can be revoked at any time, and traffic through it trains nothing.
Treat a hosted key like a password. Anything holding it can ask your AI questions, and your AI knows your documents. If one leaks, revoke it — that is what the revoke button is for, and using it costs you nothing but a reissue.
What we never do
- We do not train any model on your documents, your conversations, or anything else of yours. We do not retrain or fine-tune models at all.
- We do not read your documents for any purpose other than answering your own questions with them.
- We do not sell, rent or trade your information.
- We do not use your content to improve our product, benchmark it, or demonstrate it.
On the download tier the first of these is not really a promise at all — it is a description of a situation. Your index never leaves your disk, so there is nothing for us to train on even if we wanted to.
What we can't protect you from
A security page that only lists strengths is marketing. These are the real limits.
- Your own machine. If your computer is compromised, stolen unencrypted, or shared with someone who shouldn't read your documents, a local AI is no safer than the files it was built from. Local means the risk moves to you, not that it disappears. Full-disk encryption and a password are doing more work here than we are.
- What you choose to share. If you host an AI and give the address and key to your whole team, everyone with that key can ask it anything it knows.
- The AI being wrong. Grounding an answer in your documents makes it much more likely to be right. It does not make it certain. It can misread a table, miss a document that was relevant, or state something confidently that the source does not support. Check anything that matters.
- Instructions hidden in your own documents. If you feed it a file containing text written to manipulate a language model, that text is now part of what it reads. The internet toggle limits the damage — a sealed AI has nowhere to send anything — but it is a real category of risk and we would rather name it than pretend it away.
- Anything you paste somewhere else. Ngaro protects the documents you give Ngaro. It cannot help with the ones that go into a browser tab.
Reporting a vulnerability
If you find a security issue, please tell us before you tell anyone else, and we will work with you rather than against you. We will not pursue legal action against anyone acting in good faith to find and report a problem.
Security reports go to kiaora@ngaro.ai with "security" in the subject line, and we will come back to you.
Ngaro is based in Tāmaki Makaurau, Auckland, Aotearoa New Zealand.