🔒 Data Residency
Local Processing
Queries routed to cache or local tiers are processed entirely on your hardware. No external network calls. No data transmitted.
Cloud Escalation
Only complex queries (typically <20%) are sent to cloud providers. You control which providers are enabled and can disable cloud entirely.
Vector Cache
The default semantic cache is stored locally at cache/data/semantic_cache.sqlite3. ChromaDB is optional at cache/data/chromadb/. Embeddings are computed on-device using Ollama. No data sent to embedding APIs.
Chat History
All chat messages are stored client-side in IndexedDB (Dexie.js). The server never persists conversation content to disk beyond the scoring log.
📑 What's Logged
| Data | Stored | Contains Content? | Retention |
|---|---|---|---|
| Scoring log | Local JSONL file | No — only tier, model, cost, latency | Rolling 50K entries |
| Query trace | Redis (in-memory) | First 8 chars only (obfuscated) | Last 200 entries, lost on restart |
| MCP trace | Redis (in-memory) | Method names + truncated params | Last 100 entries |
| Server logs | stdout/file | No query content | Session only |
| Chat messages | Browser IndexedDB | Yes (client-side only) | User-controlled, deletable |
☁ Cloud Provider Policies
| Provider | Data Retention | Training Use | Notes |
|---|---|---|---|
| Anthropic (Claude) | 30 days (API) | Not used for training via API | Enterprise: zero retention available |
| OpenAI (GPT-4o) | 30 days (API) | Not used for training via API | Opt-out available |
| Google (Gemini) | Varies | Check current policy | API vs consumer terms differ |
🛡 Security
HTTPS / TLS
All traffic encrypted with self-signed TLS certificate. Required for mobile mic/camera permissions and LAN security.
API Key Storage
Cloud API keys stored in .env file with 600 permissions. Never transmitted to muLLM's own frontend or logged.
MCP Sandbox
File operations via MCP tools are sandboxed to the project directory. Path traversal is blocked.
Input Validation
All inputs sanitized. DOMPurify for HTML rendering. Content size limits enforced (50MB max).
✅ Live Compliance Checks
⚖ Your Rights (GDPR / CCPA)
Right to Access
All data is on your machine. Chat history in browser IndexedDB. Scoring log at cache/data/scoring_log.jsonl. Semantic cache at cache/data/semantic_cache.sqlite3 by default, or cache/data/chromadb/ when ChromaDB is explicitly enabled.
Right to Deletion
Clear chat: delete in-browser. Purge all query data (cache + log) via the API below. Requires explicit confirmation token.
Right to Portability
Export all stored query data (scoring log + semantic cache) as a ZIP. Scoring log contains metadata only; query text may be present in cache exports when query-content logging is enabled.
Data Minimization
muLLM routes locally by default. Cloud is opt-in. Scoring log never stores query content — only tier, model, cost, latency, timestamp. Set DATA_RETENTION_DAYS env var (default 90) to auto-purge old entries.
🔍 Auditability & Traceability
Scoring Log
Every query logged with: intent ID, category, complexity, model, tier, tokens, cost, latency, timestamp. Machine-readable JSONL.
Query Trace
Live trace on /performance shows obfuscated recent queries with full routing metadata.
Cost Tracking
Per-query, per-session, daily, and weekly cost tracking. Budget limits with automatic local-only fallback. Visible on the Cost page.
No Black Boxes
Classification rules are in router/intent.py. Routing logic in router/tiers.py. All open source, all auditable.