How private AI actually works in LinearPilot

Private AI is one of those phrases that gets stamped on everything and explained by almost nobody. If a product can't tell you what happens to the actual bytes when the AI runs, the phrase is just decoration. So here is what happens in LinearPilot, in plain terms, including the parts that are trade-offs rather than wins.

LinearPilot runs AI on external providers. There is no secret model humming away inside your network, and we would rather say that outright than let the word “private” imply an architecture we don't have. What you get instead is a provider we name, three tiers your users pick between — LinearPilot Spark, Core and Max — and a set of controls sitting between your records and that provider. Your plan defaults to one tier and credits meter the choice; the providers behind each tier are published on a page you can read rather than buried in a policy nobody opens.

Sending text to an outside provider is where most private-AI stories quietly fall apart, so it's worth being exact about ours. Before a prompt leaves, LinearPilot strips the personal identifiers out of it, sends the de-identified version, and then restores the real values in the answer that comes back. That meaningfully reduces what a third party sees. It is not a force field. The non-personal body of your text still goes to the provider, and the substitution acts on the identifiers it can detect, so it lowers exposure rather than promising zero. If that trade isn't one you want to make, the honest lever is not a hidden mode — it's the switch: AI stays off until your company turns it on, and each person grants consent separately before anything of theirs is sent.

The trade-off doesn't vanish because there's one path instead of two; it just moves somewhere you can see it. A hosted frontier model is more capable than anything most companies would stand up on their own hardware, and the price of that capability is that a third party processes your text, even de-identified. LinearPilot's position isn't that this cost is invisible. It's that you should be able to name it: which provider, on what terms, for which of your data, with every call written down. Every outbound request is logged, so “what did the AI send, and where” is a query rather than a guess.

Underneath the AI sits the unglamorous machinery that actually protects data from one day to the next, and tenant isolation is where a post like this one has to be careful, because it is the claim vendors most often overstate. Isolation in LinearPilot is real, and it lives in the application: every query that reads or writes your records is scoped to your company before it runs. The database also carries row-level security policies, and there is a test suite that keeps them honest, but the role the application connects with is one Postgres exempts from them. So the truthful sentence is that the application is what stands between two customers, not the database. We would rather name the layer actually doing the work than borrow credibility from one that isn't.

Inside a single company, record-level visibility decides who can see which records, so “everyone is in the same system” doesn't have to mean “everyone sees everything.”

Data at rest is encrypted with AES-256-GCM, and deletion is backed by crypto-shredding, which throws away the encryption keys so removed data can't be quietly resurrected later. Accounts get TOTP multi-factor authentication and breached-password blocking, which checks a new password against known-compromised lists and turns away the ones that show up in them.

There is one hazard that's specific to letting an AI read your content. Because the assistant reads documents and mail, a document can try to smuggle instructions to it, the same way a phishing email tries to smuggle instructions past a person. LinearPilot runs prompt-injection detection to catch that category of attack instead of pretending text from the outside world is always safe to follow.

None of this makes AI risk-free, and anyone claiming their AI is risk-free is selling you something. What LinearPilot tries to do is make the trade explicit and put it where you can reach it. You decide whether AI runs at all, per company and per person. Every outbound call is written down. The isolation and the encryption are there whether or not you ever think about them. That is the honest version of private AI: not a magic promise, just defaults you can inspect.