The test · quotable, portable, applies to us
Three questions for anyone selling you private AI
"Private" is the cheapest word in this industry: it can mean encrypted, or local, or merely promised. These three questions turn the claim into something checkable. Ask them of any product that wants your conversations, your documents, or your memory — including this one. No question requires trust to answer; each has evidence that either exists or does not.
1Can I read every line that runs?
Not "is there a repository somewhere." The code that touches your data — the whole path from your keyboard to disk to any network socket — can it be inspected, by you or an auditor you hire? A partial answer is a no: an open client in front of a closed service means the part you can read is not the part that holds your life.
How it's dodged: "the code is on GitHub" (a client wrapper is; the service holding your data isn't) · "our infrastructure is SOC 2 audited" (someone else read something else, under NDA) · a repo with a thousand dependencies, where the audit is technically possible and practically unfinishable.
2Can I take everything out, verified, in a documented format?
Almost every product has an export button. The test is stricter than the button: is the export complete — memory, history, documents, the derived things it learned about you — is the format documented well enough that other software can read it, and can you verify the archive matches what was inside, without trusting the vendor's word for it? An exit you cannot verify is a screenshot of a door.
How it's dodged: export gives you a CSV of chat titles · the format is undocumented JSON that only re-imports into the same product · "contact support for a full data request" — thirty days, mediated by the party you're leaving.
3When something isn't private, does the product tell me at that moment?
Not in a policy PDF, and not in a settings page you read once — on screen, at the point of use, when data is about to cross your boundary. Every real product has moments that aren't private: a remote model call, a sync, an update check. The honest ones name the moment when it happens. This is the question to ask first, because it reliably predicts the other two: a product willing to show you an uncomfortable truth at the moment it's relevant is usually being straight with you everywhere else.
How it's dodged: "see our privacy policy" · a toggle labeled "improve the product for everyone" · silence — the request simply happens, and you'd need a packet capture to know.
Our own scorecard
A test you exempt yourself from is marketing. Here is ours, with the receipts — and below it, the answers we can't give yet.
| Question | Our answer | The receipt |
|---|---|---|
| Read every line? | Yes. The core has zero runtime dependencies — the audit is actually finishable, not a gesture at a dependency tree. | The source; the
package.json has no dependencies field to argue with. |
| Take everything out, verified? | Yes. One export covers all twelve data tables, carries a per-table
SHA-256 manifest, encrypts under a passphrase we never see, and sovereign verify
checks an archive without importing it. |
The documented format, and the verify command in any install. |
| Told at the moment? | Yes. Before any message goes to a remote provider, the exact outgoing bytes — system prompt, memories, excerpts, sizes, destination host — are shown for approval, and every remote answer carries a receipt of what left. | The customs declaration, including the test that pins the preview to the real request, byte for byte. |
Where our answers run out. The test doesn't stop where our marketing would like it to. The model weights are borrowed — even open weights are someone else's artifact, trained on a corpus nobody outside can audit. The database is not encrypted at rest; the honest answer today is full-disk encryption, and we say that rather than round it up. And this product is young: the export works and is tested, but "trust us with your life's data" is earned by years, not by a page like this one. All of it is tracked, layer by layer, in the Sovereignty Ledger.
How to use it
In a sales conversation, ask all three and watch which one produces the subject change. On a website, look for the export format documentation — its absence answers question two, and usually the other two as well. For question three, find the product's most privacy-relevant moment (a cloud model call, a sync) and check what the screen says while it happens. Silence is an answer.
Most products fail the third question first. Products that pass it tend to pass the others, because the same instinct — disclose at the uncomfortable moment — is what produces readable code and verified exits.
Quote this test freely, with or against us — it works without attribution and on any
vendor. The canonical wording lives at mysovereign.ai/three-questions, and the questions
read the same everywhere we state them; a test that shifts its wording per audience is failing its own
third question.
The product built to pass it
SovereignAI is what the test looks like as software: local models, memory with receipts, disclosure at the moment of use, and an exit you can verify before you need it. The trial is one Docker command, and deleting the volume deletes every trace of you.