# Local first, cloud only after review

A practical walkthrough for using a local model to find sensitive material and prepare a minimized derivative when the local model cannot finish the useful task.

This is a pilot workflow, not a compliance certification. A model can miss identifiers, secrets, hidden content, images, metadata, and combinations of ordinary facts that reveal a person or project. Your law, contract, security policy, professional duty, and data owner's instructions always win.

## The boundary

Keep three things local:

1. the original document;
2. the findings manifest and any re-identification map;
3. the final step that restores approved names or values to the cloud model's answer.

Only a reviewed, minimized derivative may cross the boundary. If the task can be completed locally, nothing crosses it.

```text
ORIGINAL (local only)
  -> local extraction + deterministic checks
  -> local-model candidate review
  -> typed replacements + minimization
  -> human approval
       -> finish locally
       -> or send approved derivative to named cloud service
  -> inspect cloud answer locally
  -> restore values only when necessary
```

## One-document LM Studio pilot

LM Studio documents that downloaded models, document chat, and its local server can operate offline and that attached-document processing stays on the machine. Offline operation still depends on the rest of the workstation: converters, plugins, backups, sync clients, clipboard managers, and other tools can create separate data paths.

### Prepare while connected

1. Install LM Studio from its official source.
2. Download one instruction-tuned local model that fits comfortably in memory. A 7B–14B GGUF at a sensible quantization is a practical laptop test; choose quality by testing, not parameter count.
3. Download the matching LM runtime and any local embedding model the chosen document workflow requires.
4. Open a synthetic document once and confirm that the model, runtime, and attachment processing work.
5. Close LM Studio. Pause cloud sync for the test workspace and create a new local-only folder outside synced Desktop/Documents locations.

### Disconnect and configure

1. Switch off Wi-Fi and unplug Ethernet. Do not treat a VPN as offline.
2. Reopen LM Studio and load only the downloaded local model.
3. Use these conservative starting settings:

| Control | Starting value |
|---|---|
| Model | Downloaded instruction-tuned local model only |
| Context | 8,192 tokens; increase only after a memory and latency test |
| Temperature | 0 |
| Tools, MCP, web search, plugins | Off |
| Cloud model or automatic fallback | Off |
| Local server | Off; if an integration requires it, bind only to `127.0.0.1` with authentication |
| Source | Synthetic or explicitly authorized copy, never the only original |
| Output | Findings manifest first; derivative only after review |

4. Confirm that model search, update checks, web features, and any cloud-model controls cannot work while disconnected.
5. Attach the authorized copy. Keep the original closed and unchanged.

### First-pass prompt

```text
Work only with the attached local document. Do not use tools, web search, external
sources, or a remote model.

Find candidate content in these classes: DIRECT_IDENTIFIER,
CREDENTIAL_OR_SECRET, REGULATED_DATA, COMMERCIAL_CONFIDENTIAL,
QUASI_IDENTIFIER, and UNCERTAIN.

Return a table with exact text, page/section, class, reason, confidence, and a
stable proposed token such as [PERSON-001]. Do not rewrite the document yet.
Do not infer missing identities. Mark uncertainty explicitly.
```

Run deterministic local searches as well. Look for emails, phones, account and government identifiers, IP addresses, URLs, coordinates, private-key headers, high-entropy strings, connection strings, and secret assignments. Then inspect contextual combinations: exact dates, rare roles, small locations, distinctive events, diagnoses, transactions, allegations, and unusual contract terms.

### Prepare and verify the derivative

1. Approve or reject each candidate. Add anything the model missed.
2. Use stable typed tokens such as `[PERSON-001]` and `[ORG-002]`. Generalize a date, place, age, amount, or title when a token alone still allows re-identification.
3. Delete credentials and rotate real ones that crossed an unapproved boundary. Do not put credentials in a token map.
4. Prefer the smallest useful artifact: extracted clauses or a task-specific brief may be safer than a redacted copy of the full document.
5. Keep the mapping in a separate local file. Never attach it to the cloud request.
6. Start a fresh local chat and rescan the derivative. Search for every original detected span and inspect comments, tracked changes, speaker notes, hidden sheets, document properties, filenames, attachments, and images.
7. Have a person approve the exact derivative, destination, purpose, model/service, region, and retention terms.

Important: document chat often retrieves selected passages instead of placing every page in context. That is useful for questions, but it is not an exhaustive redaction pass. Long files must be parsed and scanned page by page or chunk by chunk with overlap. Any skipped, unreadable, or uninspected content keeps the document local.

## Red, amber, green router

Use the highest applicable route.

### Red — local or approved private infrastructure only

Credentials, identity evidence, protected health or financial records, privileged legal material, child or vulnerable-person data, sealed or investigation material, safety-critical or export-controlled information, an unredacted board/client/acquisition file, or anything with unclear authority or service terms.

Removing a name does not make a red document amber when context still reveals the subject.

### Amber — reviewed derivative to a named approved service

Contracts, client narratives, internal reports, or source passages whose direct identifiers and distinctive combinations can be removed or generalized without defeating the task. The derivative needs a second scan, human approval, and known processor, region, retention, logging, training, subprocessor, and deletion terms.

Send no token map. Send no surrounding pages merely because they are convenient.

### Green — approved or genuinely public

Published material, genuinely synthetic tests, checked templates, or content explicitly approved for this external purpose. Still minimize the request and verify the actual product/account settings.

The decisive re-identification question is: could someone who knows the organization, geography, event, role, date, or surrounding news identify the person, transaction, client, or project without the removed name? If yes or uncertain, keep it local.

## When the laptop stops being enough

Move from a one-person pilot to governed private infrastructure when any of these becomes true:

- more than one person needs the workflow or its token map;
- the source is regulated, privileged, safety-critical, or contractually restricted;
- files are too long, multimodal, or numerous for exhaustive local inspection;
- multiple concurrent jobs, predictable latency, or always-on availability matter;
- access control, retention, audit logs, legal hold, backups, deletion evidence, or incident response are required;
- the model must reliably apply company rules and exceptions that a prompt cannot hold;
- corrections are recurring enough to become a training or evaluation dataset.

At that point, use an organization-controlled service with identity, isolated storage, approved models, versioned source documents, a policy engine, evaluation gates, and a named owner. DGX Spark can prove and serve a bounded local workflow, but hardware alone does not provide governance.

## Keep the learning portable

Bayer's Microsoft customer story describes a Phi model fine-tuned on proprietary product-label data, regulatory rules, and expert-authored Q&A. Discovery Bank's story describes five fine-tuned 4o-mini and 4.1-mini variants for company terminology, SQL formatting, and workflow templates. Those are useful vendor-reported examples of teaching smaller models a bounded job.

The durable asset is not only the fine-tuned endpoint. Keep these outside it:

- source provenance and versioned rules;
- prompts and response schemas;
- corrections as exportable examples;
- an untouched evaluation set;
- identity and permission policy as code or documented configuration;
- model, data, and deployment manifests;
- latency, quality, cost, and failure history.

Ask one portability question before investing further:

> Could we replace the model in 30 days using only the artifacts we can export today, then prove the replacement against the same holdout?

Microsoft says customer inputs, outputs, embeddings, and training data for Azure-hosted direct models are not made available to model providers or used to improve foundation models without permission, and that a customer's fine-tuned model is exclusive to that customer. Exclusivity is a privacy property; it is not the same as downloadable weights or provider independence. Test export and replacement explicitly.

## Why product behavior matters as much as the prompt

In July 2026, an independent wire analysis of Grok Build 0.2.93 found a separate upload path sending a Git bundle with tracked files and history even when the agent was instructed not to open files. The researcher later reported that xAI disabled the upload server-side. The evidence established transmission and storage in the tested setup, not training, employee access, or identical behavior for every account.

The practical lesson is narrower and more useful: “do not read this” constrains the model's task, not necessarily the product's packaging, logging, tracing, sync, or upload behavior. Test the whole data path and distinguish five different promises: no training, no retention, no human review, no upload, and local-only processing.

## Sources

- [LM Studio offline operation](https://lmstudio.ai/docs/app/offline)
- [LM Studio network-server warning](https://lmstudio.ai/docs/developer/core/server/serve-on-network)
- [Bayer and Phi — Microsoft customer story](https://www.microsoft.com/en/customers/story/25255-bayer-azure-phi)
- [Discovery Bank fine-tuning — Microsoft customer story](https://www.microsoft.com/en/customers/story/26157-discovery-bank-azure-openai-in-foundry-models)
- [Microsoft Foundry data, privacy, and security](https://learn.microsoft.com/en-us/azure/foundry/responsible-ai/openai/data-privacy)
- [Original Grok Build wire analysis](https://gist.github.com/cereblab/dc9a40bc26120f4540e4e09b75ffb547)

Download the companion `scrub-sensitive-documents` Codex skill from the same page. The skill stops at the handoff boundary: it prepares the derivative and review package but does not send the document to a cloud service.