1
Personal data never reaches a third-party inference provider
Not Kimi, not Qwen, not Claude, not anyone. When a request is marked
personal and the only available destination is an external model, Shamwari
returns 409 scope_requires_local_inference and answers nothing.It is not quietly downgraded to public knowledge. A downgrade would
answer confidently while withholding the very data the question was about,
and the person asking would have no way to know something was missing. An
error is worse service and better faith.The check runs twice on purpose: once at the edge, so a refused request costs
nothing, and once inside the service that owns the database, where the edge
cannot overrule it. Two implementations, in two languages, deliberately not
sharing code — because one check is one bug away from a leak, and this leak
would not be an outage. It would be a broken promise.2
Only open-weight output may train Shamwari Mind
Every logged exchange is stamped with a provenance class at the moment it is
generated, never inferred afterwards when the evidence is gone.Anthropic’s and OpenAI’s terms bar using their output to train a competing
model. Qwen’s and Kimi’s permit it. So the stamp decides eligibility, and it
is enforced three times over:
- The router assigns it, and the premium tier is hardcoded
restricted. - The service refuses to store an exchange without a valid one, rather than defaulting it to something permissive.
- The training corpus carries a database constraint that a restricted row physically cannot satisfy.