# How Vane Ensures User Privacy with AI Answering: A Technical Architecture Breakdown

> Discover how Vane ensures user privacy with AI answering using local databases, environment variables, offline LLMs, and self-hosted search. Learn the technical architecture.

- Repository: [Kushagra Srivastava/Vane](https://github.com/ItzCrazyKns/Vane)
- Tags: architecture
- Published: 2026-03-11

---

**Vane ensures user privacy with AI answering by storing all conversational data in a local SQLite database, loading secrets exclusively from environment variables, and supporting fully offline operation via local LLMs and self-hosted search backends.**

The Vane project (ItzCrazyKns/Vane) is engineered as a privacy-first AI assistant that keeps user data under the owner's control. Unlike cloud-native alternatives that transmit queries to centralized servers, Vane implements a zero-knowledge architecture where prompts, responses, and metadata never leave the user's environment unless explicitly configured to do so.

## Local Data Retention with SQLite and Drizzle ORM

All conversational history resides in a local SQLite database rather than external servers. According to [`src/lib/db/schema.ts`](https://github.com/ItzCrazyKns/Vane/blob/main/src/lib/db/schema.ts), Vane defines a strict schema using Drizzle ORM that stores messages, chat threads, and response metadata on the local filesystem.

This design eliminates telemetry risks associated with cloud-based chat storage. When a user submits a query, the system writes both the input and AI-generated response to the local database using standard SQL transactions:

```typescript
// Data never leaves the host machine
import { db } from '@/lib/serverUtils';
import { messages } from '@/lib/db/schema';

await db.insert(messages).values({
  messageId: crypto.randomUUID(),
  chatId: 'chat-123',
  backendId: 'ollama',
  query: 'Explain privacy controls',
  createdAt: new Date().toISOString(),
  responseBlocks: [{ type: 'text', content: response }],
});

```

## Environment-Only Secret Management

Vane eliminates the risk of accidental credential exposure by refusing to persist API keys in configuration files. In [`src/lib/config/index.ts`](https://github.com/ItzCrazyKns/Vane/blob/main/src/lib/config/index.ts), the application strictly loads sensitive values such as OpenAI API keys and SearXNG URLs from environment variables only.

This approach ensures that [`config.json`](https://github.com/ItzCrazyKns/Vane/blob/main/config.json) on disk never contains plaintext secrets. If an attacker gains access to the filesystem, they cannot extract LLM provider credentials from configuration files because the application never writes them there.

## Self-Hosted Search with User-Controlled SearXNG

Web search functionality operates through user-specified SearXNG instances rather than proprietary search APIs. The implementation in [`src/lib/searxng.ts`](https://github.com/ItzCrazyKns/Vane/blob/main/src/lib/searxng.ts) routes all search queries to a URL defined by the `SEARXNG_API_URL` environment variable.

By default, users can point this to a local SearXNG instance running on `localhost`, ensuring search queries never traverse the public internet:

```typescript
// Configure private search backend via environment
process.env.SEARXNG_API_URL = 'http://localhost:4000';

// Queries go only to user-controlled infrastructure
import { searchSearxng } from '@/lib/searxng';
const { results } = await searchSearxng('privacy preserving architecture');

```

## Air-Gapped Operation with Local LLMs

For users requiring complete network isolation, Vane supports local model execution via Ollama. The model selector in [`src/components/MessageInputActions/ChatModelSelector.tsx`](https://github.com/ItzCrazyKns/Vane/blob/main/src/components/MessageInputActions/ChatModelSelector.tsx) allows switching to locally-hosted models that process data entirely on-device.

When configured to use a local endpoint, the `OpenAILLM` class in [`src/lib/models/providers/openai/openaiLLM.ts`](https://github.com/ItzCrazyKns/Vane/blob/main/src/lib/models/providers/openai/openaiLLM.ts) sends requests to the user's Ollama instance rather than cloud providers:

```typescript
import { OpenAILLM } from '@/lib/models/providers/openai/openaiLLM';

// Purely local execution - no outbound HTTP to third parties
const localLLM = new OpenAILLM({
  apiKey: 'dummy',  // Required field but unused for local models
  model: 'llama3',
  baseURL: 'http://localhost:11434/v1',  // Ollama endpoint
});

const response = await localLLM.chat({
  messages: [{ role: 'user', content: 'How does Vane protect privacy?' }],
});

```

## Minimal Data Transmission for Cloud Providers

When users opt to use cloud LLM providers (OpenAI, Anthropic, etc.), Vane transmits only the essential payload required for the API call. The provider implementation in [`src/lib/models/providers/openai/openaiLLM.ts`](https://github.com/ItzCrazyKns/Vane/blob/main/src/lib/models/providers/openai/openaiLLM.ts) sends conversation text over TLS-encrypted channels without appending usage telemetry, device identifiers, or metadata harvesters.

This **provider-only communication** principle means Vane adds no intermediary tracking between the user and the LLM endpoint, unlike many AI intermediaries that log requests for analytics.

## Summary

- **Local SQLite storage**: All chat history persists in [`src/lib/db/schema.ts`](https://github.com/ItzCrazyKns/Vane/blob/main/src/lib/db/schema.ts) defined tables on the local filesystem, never on external databases.
- **Environment-variable secrets**: Configuration in [`src/lib/config/index.ts`](https://github.com/ItzCrazyKns/Vane/blob/main/src/lib/config/index.ts) reads API keys from `process.env` only, avoiding disk persistence of credentials.
- **User-controlled search**: The SearXNG integration in [`src/lib/searxng.ts`](https://github.com/ItzCrazyKns/Vane/blob/main/src/lib/searxng.ts) routes queries to self-hosted instances specified by the user.
- **Optional offline LLMs**: Local model support via Ollama endpoints ensures AI answering functions without network connectivity.
- **Zero telemetry**: The codebase contains no analytics modules; network requests are limited strictly to configured provider endpoints.

## Frequently Asked Questions

### Does Vane store my API keys in configuration files?

No. According to [`src/lib/config/index.ts`](https://github.com/ItzCrazyKns/Vane/blob/main/src/lib/config/index.ts), Vane loads all secrets exclusively from environment variables. The application never writes API keys or SearXNG URLs to the persistent [`config.json`](https://github.com/ItzCrazyKns/Vane/blob/main/config.json) file, preventing accidental exposure of credentials through filesystem access.

### Can I use Vane without an internet connection?

Yes. By configuring a local Ollama instance as your LLM backend and pointing `SEARXNG_API_URL` to a local search instance, Vane operates entirely within your network perimeter. The database schema in [`src/lib/db/schema.ts`](https://github.com/ItzCrazyKns/Vane/blob/main/src/lib/db/schema.ts) handles all storage locally using SQLite, requiring no cloud connectivity.

### What data leaves my machine when I use Vane with OpenAI?

Only the conversation text required to generate a response is transmitted. As implemented in [`src/lib/models/providers/openai/openaiLLM.ts`](https://github.com/ItzCrazyKns/Vane/blob/main/src/lib/models/providers/openai/openaiLLM.ts), Vane forwards your messages to the OpenAI API endpoint over HTTPS without attaching usage logs, analytics metadata, or device identifiers.

### How does Vane handle search privacy?

Vane delegates search functionality to SearXNG instances controlled by the user. As defined in [`src/lib/searxng.ts`](https://github.com/ItzCrazyKns/Vane/blob/main/src/lib/searxng.ts), the application sends queries only to the URL specified in your environment variables, allowing you to route searches through your own self-hosted infrastructure or trusted privacy-preserving instances.