Concepts
The model that answers you lives in your node
On paid tiers, the language model that writes your answers runs inside your own node, on compute dedicated to you. Your question, the passages retrieved from your documents, and the generated answer never pass through a shared inference service. This page explains how that works, what still travels between your node and the platform, and what the trade costs.
A writer in residence, not a phone line
Local RAGdescribes your node's in-house archivist: the part that reads and files your documents without mailing them to anyone. But finding the right passages is only half of answering a question. Someone still has to read those passages and write the reply, and most AI products do that over a phone line: they call an outside model service, read your documents to it, and transcribe what it says back.
Your node does not phone out. It keeps a writer in residence: a compact language model installed on the node itself, running on the same CPU that does everything else. The archivist hands the writer the relevant passages, the writer drafts a grounded answer, and the draft leaves the building only to be delivered to you. No outside service hears the question, sees the passages, or logs the answer.
What travels, and what never does
When you ask a question in the dashboard, the platform hands your node the question and nothing else, over the same private, encrypted channel it already uses to manage the node. Your node searches its own vault, ranks what it finds, decides which passages are good enough to use, writes them into a grounded prompt, and calls its resident model. What comes back to the platform is finished text and a list of the sources the answer cites. The platform's role is courier between you and your node, never a reader with its own model on the line.
Every step that has to read your passages happens on your node, and that is not a coincidence. It is the rule the design follows: ranking passages means reading them, building a prompt from them means holding them. So those steps live where the passages already are. Doing the ranking on our side would have meant shipping your text to us and then shipping it back to your node to be answered, which is a strange way to keep a promise about not seeing it.
Refusal is a feature
If your node's model runtime is unreachable or not provisioned, the platform refuses to answer rather than quietly routing your question to a shared service. The same applies to an account whose tier cannot be determined. Degrading silently would break the promise; failing closed keeps it.
Where Community differs
Community tier answers are generated by a managed model service brokered by the platform. That is a deliberate boundary, not a missing feature: a resident model consumes real, dedicated compute on every node that carries one, and the free tier runs on shared infrastructure. Moving up to a paid tier is, concretely, the moment the writer moves in and the phone line is cut.
Honest limits
A model that fits inside your node is smaller than the frontier models running in dedicated GPU datacenters, and it writes more slowly: generation runs on your node's CPU, so a full answer can take tens of seconds rather than arriving instantly. For the task it is given, compressing passages you already own into a grounded answer, a compact model holds up well; it is not a general-purpose replacement for a frontier assistant. Answers are also generated one at a time per node, so simultaneous questions queue rather than run in parallel. These are the costs of keeping your content off shared infrastructure, and we would rather name them than hide them.