Skip to content
Locallution

Privacy & security

Data protection is only one part. Security has to be controllable.

Processing sensitive data locally reduces external data flows and dependencies. But a local system is not automatically a secure system. That is why at Locallution we look not only at the place of processing but at the entire security architecture around the AI system: user rights, administrative access, network connections, updates, backups, logging, software components in use and recovery.

The difference

What matters is where the computing happens

Any AI has to read your documents to work with them. The only question is where: behind your office door — or in a data centre you will never set foot in.

AI in the cloud

  1. Your document is uploaded and leaves your network

    The moment you attach a file or paste in text, it is on its way. From then on, confidentiality is no longer in your hands.

  2. It travels across the internet

    The transfer itself is encrypted. That protects against being read en route; it says nothing about what happens at the far end.

  3. Someone else’s data centre processes the content

    There the content is processed, logged, cached and — depending on the provider — inspected for quality assurance. Which copies exist and for how long is set out in the terms, and the provider can change those.

  4. What is logged or retained there is something you cannot verify

    You cannot look for yourself. You can examine certificates and contracts, but not the system. For anyone bound by professional confidentiality, that is the actual problem.

From the first stop onwards, confidentiality rests on somebody else’s promise.

AI on your own device

  1. Your document stays on your own drive

    The file stays on your drive. The AI reaches into the place where it already sits instead of sending a copy somewhere else.

  2. The device on your premises processes it

    The computing happens on the device in your own rooms. The processing itself needs no route to the outside; which connections the device may make besides — for updates or remote maintenance, say — is defined and logged.

  3. The answer appears at your desk

    The answer appears in your browser. Whatever was produced along the way is inside your network, under your own access rights.

Every stop in the processing lies within your own rooms. Which external connections exist besides is for you to define – and to verify.

Professional confidentiality

For a confidential profession this is not a question of fines

The GDPR has fines. Professional law has disciplinary proceedings, and in Germany the criminal law applies on top of that to the classic confidential professions. That is why these professions hesitate over AI — and why local processing means something different to them than it does to an online shop.

Lawyers and law firms

A lawyer’s duty of confidentiality covers everything learned in the course of the retainer, whether or not it is marked confidential.

Germany
§ 43a BRAO establishes the duty; § 203 StGB makes breaching it a criminal offence. § 203(3) StGB permits assisting parties to be involved — on conditions that have to be examined and documented.
Austria
§ 9 RAO imposes the duty of confidentiality; § 152 StPO protects professional secrecy in proceedings. Breaches are pursued under disciplinary law.

What a cloud service makes of it

Sending a pleading containing client data to an AI service means bringing a third party into the retainer. That is not ruled out, but it calls for an assessment: who gains access, where the processing happens, which copies come into existence, how the supplier is bound. With a provider outside the EU that assessment regularly cannot be completed, because the actual access paths are not disclosed.

What local processing changes

If the processing runs on a device inside your own offices, that can considerably reduce the number of third parties involved: for the AI itself there is no provider to bind and no third-country transfer to justify. Which service providers are nevertheless involved — for remote maintenance, say — is documented during system planning; the assessment does not become unnecessary, but it becomes manageable and answerable.

Doctors and medical practices

Medical confidentiality exists alongside data protection law and is older than it. It covers even the fact that a treatment took place.

Germany
§ 203 StGB together with the professional codes of the regional medical chambers. Health data is additionally a special category under Art. 9 GDPR.
Austria
§ 54 Ärztegesetz establishes the duty of confidentiality; § 121 StGB makes breaching professional secrecy a criminal offence. Art. 9 GDPR applies on top.

What a cloud service makes of it

A medical finding sent to a cloud service to be summarised contains health data. Processing it requires a basis under Art. 9 GDPR and a processing agreement that matches the raised level of protection — and, separately, an answer to the question of medical confidentiality, which a data protection consent does not automatically settle.

What local processing changes

If the analysis stays in the practice, that reduces additional external data transfers: the processing remains within the circle of people already bound to secrecy, and anyone with access beyond that is named and logged. The processing of personal and in particular health data nevertheless still has to be assessed under data protection law and secured accordingly — local makes the assessment smaller, not unnecessary.

Tax advice and auditing

The duty of confidentiality extends to a client’s entire financial position, including matters the client would not be obliged to disclose at all.

Germany
§ 57(1) StBerG, backed by the criminal sanction in § 203 StGB. § 62a StBerG governs the involvement of service providers and sets its own requirements.
Austria
§ 91 Wirtschaftstreuhandberufsgesetz establishes the duty of confidentiality; § 121 StGB backs it with a criminal sanction.

What a cloud service makes of it

Bookkeeping data and annual accounts draw a complete picture of a business. If they leak to a service provider, the damage cannot be undone by filing a notification. § 62a StBerG expressly permits service providers to be used, but requires selection, contractual obligation and monitoring — and the last of those is in practice not achievable with a large cloud provider.

What local processing changes

If the processing takes place in your own office, the chain becomes short: for the AI itself there is no provider to select, bind and monitor. What remains is manageable — the service providers with access for maintenance, say, are named in the documentation, with an agreement and a log. That is a level of control that can actually be sustained.

Property, insurance, engineering, consulting

Here the issue is not a criminally sanctioned duty of secrecy but contractual confidentiality and the protection of trade secrets — often combined with large volumes of other people’s personal data.

Germany
The GDPR together with the BDSG; for know-how, the Geschäftsgeheimnisgesetz, which makes protection conditional on appropriate secrecy measures.
Austria
The GDPR together with the Datenschutzgesetz; for trade secrets, §§ 26a ff. UWG, with a comparable requirement as to secrecy measures.

What a cloud service makes of it

Confidentiality agreements with clients and investors frequently prohibit passing documents to third parties or into third-party systems. A cloud service is such a third party, however securely it is run. With trade secrets there is a further point: protection depends on the measures actually taken. Anyone who puts costings into someone else’s system has to be able to explain why that was still appropriate.

What local processing changes

Local processing with documented access and data flows lets you give such an undertaking precisely — and evidence it in a pitch or in due diligence: where the documents are held, who has access, which systems are involved. A constraint turns into an argument.

These sections describe the legal position in outline and are not legal advice. Whether a particular kind of processing is permissible in your case depends on circumstances we do not know. For the professional-law assessment, your chamber or professional body is the right place to ask — and in case of doubt your own profession, which judges these questions better than any IT supplier.

Data protection

Six statements we can substantiate

Each of these statements has a technical cause behind it rather than a declaration of intent. That is why each one is followed by a sentence saying what that cause is.

  • The data stays in the business

    Because the processing runs on a device in your own rooms and the documents are read from your own drive. Which connections the device may make to the outside — for updates or remote maintenance, say — is defined during planning, documented, and controllable in your firewall.

  • No cloud for the processing

    Because the language model sits on the device and computes there. The computing power others rent is standing in your cupboard — that is the whole difference. Whether an external source is connected besides is your explicit decision, not the provider’s.

  • Nothing is passed to an AI provider

    Because for the processing itself no AI provider is involved who could receive your input. That also settles the question of whether anyone else’s models are trained on your documents.

  • Your own hardware, on your own premises

    Because the device stands with you — bought or rented. You decide through your own user accounts who has access, and you see in the documentation who may access it for maintenance besides.

  • An architecture that makes the paperwork smaller

    Because local processing can considerably reduce the number of external recipients and processors, and the remaining ones — for remote maintenance, say — are named and documented. The processing itself still has to be documented; we supply the details for it.

  • Control you can verify

    Because you can record the device’s network traffic. On this question trust is the weakest instrument; we prefer proof.

Cybersecurity

NIS2 and local AI

The European NIS2 Directive raises the requirements for technical, organisational and operational cybersecurity for the organisations it covers.

These include, among other things, risk analysis, handling of security incidents, backup and recovery, supply chain security, secure maintenance of IT systems, vulnerability management, access controls, cryptography and multi-factor authentication.

The specific legal implementation is carried out by national legislation in each EU member state. For the AI infrastructure we deliver, relevant technical requirements can be taken into account from the outset — during planning, setup and ongoing support.

In Austria, the national transposition of the NIS2 Directive is carried out in particular through the NISG 2026.

What we provide for this within the AI infrastructure

  • Access and role model

    Who may do what: users, administrators and maintenance access are set up separately, with as few rights as necessary.

  • Network and interface concept

    Which systems the AI system may reach, and which may reach it, is defined before go-live — including the question of whether an external connection is needed at all.

  • Backup & recovery

    What is backed up, where and how often, and how long a restore takes — agreed before it matters.

  • Patch and update concept

    Security and software updates are checked and installed in a controlled way — never unnoticed, never untested.

  • Logging and traceability

    Access to and changes in the system are logged, so that it can be established afterwards what happened and when.

  • Component and supply chain documentation

    Which software, which models and which dependencies make up the system is kept in a list — the basis for any assessment of the supply chain.

  • Documented handover

    Architecture, data flows, access and the agreed measures are recorded in writing at handover and kept up to date when something changes.

What this does not mean

Locallution does not replace a legal NIS2 assessment, and installing a single system does not make an entire organisation NIS2-compliant.

Within the AI infrastructure we deliver, we create a technical and documentary basis on which relevant security requirements can be taken into account and made traceable for the people responsible internally.

The specific legal assessment depends on the respective EU member state, the size of the organisation, its sector and its individual classification.

More on NIS2 and local AI

Side by side

Cloud and local, point by point

Nine questions that come up before any decision anyway. Two of them go in favour of the cloud — we write them down all the same, because a table in which one side wins everything is worth nothing.

Where your data is processedOn the provider’s servers, at a location the provider decides. Which copies are created where cannot be established from outside.With local processing, the organisation directly controls the place of processing, the infrastructure and the data flows itself. The location is a fact you can see, not a promise in a contract.
Control over your dataYou rely on contracts and certificates. If the provider changes its terms, you find out by email.You hold the authority. You decide who has access, through your own user accounts.
Dependence on the internetWithout a connection the work stops. The same applies during an outage at the provider.Keeps running on your own network, even when the line goes down.
Response timeWhere the cloud is aheadUsually fast, but it depends on the provider’s load and on your connection.Consistent, because nobody else is working on the device. With very large models the cloud is faster.
Capability of the modelsWhere the cloud is aheadAccess to the largest models currently available.Models that fit on the device. That is enough for summaries, answers drawn from your own documents and correspondence; for open-ended writing at the highest level the cloud is ahead.
Working with your own documentsYour documents have to be uploaded for this — precisely the step that is problematic under professional confidentiality rules.The AI works on your own archive, because it is in the building anyway. No upload, no detour.
GDPR basisData processing agreement, assessment of the transfer to a third country, documentation of access paths, entry in the record of processing activities.Far fewer external recipients: the AI computes in-house. Which service providers are nevertheless involved — for remote maintenance, for instance — is documented during planning. The processing itself still has to be documented.
Confidentiality and professional dutyPassing data to a service provider has to be assessed case by case and reconciled with the duty of confidentiality.The processing stays within the circle of those already bound to secrecy. Anyone with access beyond that, for maintenance for example, is named, contractually bound and logged.
Cost structureAn ongoing subscription, usually per user per month. Costs grow with the team and continue for as long as you use it.A one-off purchase of the device, then electricity and support. The number of staff makes no difference.
If the provider changes, raises prices or disappearsPrice changes, altered terms or a discontinued service hit you directly. Your data is held there.The device stands in your building and keeps working. Even if one day we no longer exist.

There are uses for which a cloud is the better choice — publicly available research with no connection to client data, for instance. The question is not which model is better, but which one suits your documents.

This website

Check it on us first

A supplier who sells data sovereignty and loads its typefaces from Google has not read its own promise. Open your browser’s network tab and reload this page — you will not find a single outside domain.

What the privacy notice says

  • No cookies, no consent banner

    We set no cookies, because we have nothing to store. A banner asking for permission would have no subject.

  • No analytics, no tracking

    No Google Analytics, no Matomo, no counting pixels. We do not know how long you have been here, and we do not need to.

  • Typefaces from our own server

    The fonts sit with us. Loading them through Google Fonts would send your IP address to the United States before the first letter appeared.

  • No embedded third-party content

    No map, no video from a video platform, no booking widget, no captcha. Everything you see here comes from our own server.

  • Hosted in the European Union

    The host is named in the privacy notice. Anyone who can look it up does not have to take it on trust.

  • No form service, no captcha

    Your enquiry reaches us directly, with no third-party form provider in between. Which mailbox it lands in, and who operates that mailbox, is named in our privacy notice.

Frequent questions

What we are asked most often in a first conversation

Twelve questions with answers. Where the answer is a drawback, the drawback is written down — you would find it yourself anyway.

Running it and keeping it running

Does this really work without an internet connection?

Yes. The language model sits on the device and does its computing there. Working with your documents needs no connection to the outside world.

An internet connection is needed for two things only: for the updates we install, and if you specifically ask for a function that draws on outside sources. Both can be switched off without the AI stopping work.

Who maintains the device?

We do. Support covers updates to the language models and the system, monitoring that everything works, and one contact who knows your organisation.

If you would rather take that on yourself, you can — the device belongs to you. It is not necessary.

What happens if it breaks?

You get a replacement device. Your data does not live on the device alone; it is stored according to the backup arrangement we agree with you during installation — inside your network, not in a cloud.

The models and the configuration can be reproduced. A replacement means downtime, but no data loss and no setting everything up again by hand.

What does it cost to run in electricity?

The devices are built for low consumption and draw very little when idle. It only becomes noticeable while computing is actually going on.

We give the figures for the devices we use in the quotation, because they differ from class to class. Set against a subscription per member of staff, the item does not weigh much either way.

Capability and limits

How capable is a local AI compared with ChatGPT?

For free text production at the very highest level, and for genuinely hard reasoning, the large cloud models are ahead. That is a matter of computing power and there is no arguing it away.

For the tasks this is actually about, the picture reverses: summarising, answering questions from your own files, drafting correspondence, sorting receipts. A local model that knows your archive is more useful at that than a larger model that is not allowed to know it.

How do our documents get into the system?

Through the filing you already use. As a rule a folder or a drive is connected; the AI reads from there and puts nothing in a second place.

For scanned material, text recognition is added. We examine connections to the usual practice-management, medical and accounting programs during the analysis — what is possible depends on the interfaces your program offers.

Do we need an IT department?

You do not need an AI team of your own. We take care of setup and integration, and coordinate network, access rights, data sources and security requirements with your internal IT or your existing IT provider where needed. To your staff, using it afterwards looks like a chat window in the browser.

If there is an IT provider, we bring them in from the start: the device sits in the network they look after, and network boundaries, user accounts and backup are agreed with them, not around them.

What about updates?

We install security updates for the system and new model versions as part of the support, by arrangement and outside your working hours.

An update only reaches you if it gives you something. There is no automatic switch to a new model that behaves differently from the one your team has grown used to.

Law and data protection

Does our data really stay in the building?

Yes, and it can be checked. The device sits in your network; which connections it may make to the outside is settled during installation and can be controlled in your firewall.

You do not have to take our word for it: you can have the device’s network traffic recorded. We think that is the best proof there is, and we actively support it.

Do we need a data processing agreement?

Local processing can considerably reduce the number of external recipients and processors: the AI itself computes on your device, not at a provider. Which service providers are nevertheless involved in actual operation – for instance through remote maintenance, external interfaces or other IT services – is documented transparently during system planning.

For our support an agreement is usually necessary, since maintenance access to the device could expose personal data to us. We provide the document and set up the access so that it is logged and stays traceable.

Getting started

How long does setting it up take?

From quotation to running system is usually a few weeks, largely determined by the delivery time of the device.

The installation itself takes half a day, the training about two hours. Your own effort comes down to two appointments.

Can we try it first?

We show it to you at an appointment on a device like yours — if you wish with an uncritical document of your own, so that you can see how it handles your material.

Whether a trial on your own premises is possible beyond that is something we settle in the first conversation. It depends on which class suits you and which device happens to be free.

A conversation, not a sales call.

We look at how you work today and work out whether local AI suits your practice. If it does not, we say so — you save weeks of research.

Free process analysis

Or simply call: +43 681 10138168