The ledger · our own audit, updated August 2026

The Sovereignty Ledger

"Sovereign AI" is a claim most products make and none audit. This is our audit of ourselves.

Every layer of the stack, what we actually control, what we don't, and what your exit is. It is maintained under one rule: an unknown is reported as unknown, not rounded up to a feature.

Truly sovereign AI — every layer owned, down to the model's weights and the data they were trained on — does not exist in 2026, for us or anyone. What this product builds is maximum achievable sovereignty at every layer, every compromise disclosed, every exit built before the door.

The ledger

Layer	Status	What you control	The honest compromise	Your exit
Your data	Sovereign	Everything: SQLite in a directory you choose, no hosted control plane, no telemetry, secrets never exported.	No at-rest database encryption — use operating-system disk encryption. Plain HTTP on localhost.	Checksummed, optionally encrypted export in a documented open format any tool can read.
Provenance	Sovereign	Every memory records how it entered, from which conversation, which model wrote it, and when it changed.	Records predating this tracking honestly say "unknown" — we refuse to backfill a guess.	Provenance round-trips through export; the portfolio carries receipts into any other tool.
Runtime	Sovereign	Zero npm dependencies — the code you audit is the code that runs. Single binary or run from source.	Node.js itself (and V8 under it) is a runtime we did not write or audit.	Runs from source with nothing but Node. Every release turns MIT within two years, so the code survives us.
Retrieval / knowledge	Sovereign	Dependency-free local parsing (PDF, DOCX, ZIP). Keyword search always works offline.	Semantic embeddings require an embedding model — see the model layer.	Search degrades gracefully; documents re-export as-is.
Distribution	Conditional	Checksums on every release; signatures when configured; reproducible path is clone-and-run.	Binaries are unsigned by an OS vendor, and the release host is a single distribution point.	Source checkout — the zero-trust install that needs none of our artifacts.
Compute (bring your own)	Conditional	Hardware you own, host-key pinning, token hashes only, verifiable delete.	Rented GPUs are tenancy: the marketplace owns the disk, and provisioning exposes the instance token. Disclosed in the deploy plan before you provision.	Stream your data home; destroy with verified data purge.
The model	Borrowed	Where inference runs, which model, per persona — local Ollama, FreeToken for frontier-class sparse MoE models on the GPU you own, any OpenAI-compatible server, or your own API key. A model's chain-of-thought is shown live and never stored. Before any remote call, exactly what would leave — prompt, memories, excerpts, history — is shown, and every remote answer carries a receipt of how much left and to which host.	The weights are someone else's artifact — trained on unknown data with unknown priors, unauditable in practice. Ollama is a de-facto dependency with its own registry; FreeToken is weeks old, NVIDIA-only, and has no request auth (keep it on loopback).	Models are swappable per persona in minutes; recipes and fine-tuning lineage are portable data.
Cognition who writes your memory	Conditional	Machine-written memories name their authoring model. A "cognition stays home" switch restricts memory-writing to local endpoints even when chat uses a remote provider. What a remote model would read is shown before it leaves, and that declaration names the model that would write memory afterwards.	With the switch off and a remote provider, a third party's model is the lens deciding what is durable about you — disclosed at the point of use.	Turn the switch on, or delete any machine-written memory — the ledger shows exactly which those are.

Everything an individual owns here

The ledger above audits claims. This list enumerates what a person actually holds in this product today, each backed by a shipped mechanism rather than an aspiration.

Your hardware — it runs where you decide: laptop, homelab, your own server, even a rented GPU with the trade-offs printed before provisioning.
Your runtime — zero-dependency, fair-source code; the single binary embeds the same files you can read in the source.
Your data — one folder you can copy, where deleted means zeroed on disk, not soft-hidden.
Your AI's identity — its name, personas, and system prompts are records you edit and export, not settings a vendor hosts.
Your models — local open weights, swappable per persona, up to frontier-class sparse MoE models on the GPU you already own (FreeToken); built into named artifacts on an endpoint you control.
Your fine-tuning — datasets you curated, consent you recorded, adapters trained on a trainer you operate, lineage kept end to end.
Your memory — every durable fact carries its origin, source conversation, authoring model, and edit time. Receipts, not vibes.
Your cognition policy — you decide which models may write memory, and whether automatic learning runs at all.
Your knowledge — documents parsed on your machine by dependency-free parsers, into an index you can preview before any model sees it.
Your history — conversations born here or imported from other assistants, plus records mined from your own inbox, each carrying the evidence it was built from.
Your access — localhost by default; your own network behind your token; editors, browser, and other AI clients all reading the store you own.
Your exit — the checksummed export in a documented open format, optional passphrase encryption, a pasteable portfolio, and verifiable deletion. Tested, not promised.

What we will not do

Custody of your credentials — no cloud connectors holding your bank or email logins. Data comes in through exports you fetch yourself.
A hosted control plane — there is no SovereignAI server your instance reports to, and there never will be.
Silent downgrades — when a sovereignty property cannot hold, the product says so at the point of use instead of averaging it into a green checkmark.

How to read a competitor's page against this one

Ask three questions of any product claiming to be private AI:

Can I read every line that runs?
Can I take everything out, verified, in a documented format?
When something isn't private, does the product tell me at that moment?

The test, expanded and applied to ourselves: /three-questions.

This ledger is our answer sheet. Demand one from everyone else.

See the product behind the ledger

A private AI command center that runs as one file on your machine — no account, no cloud, works offline.

Run the open trial — one command