How Does AI-Berkshire Ensure Data Privacy? A Three-Layer Architecture Explained

AI-Berkshire ensures data privacy through a privacy-by-design architecture that restricts all data sources to public information, isolates processing in credential-free tools, and enforces automated grep scanning to block accidental leakage before publication.

The open-source repository xbtlin/ai-berkshire implements a zero-trust approach to sensitive data, ensuring that no private user information, internal credentials, or confidential materials ever enter the system. According to the source code, this is enforced through a strict three-tier architecture that separates data acquisition, processing, and validation into isolated layers with explicit privacy guardrails.

The Three-Layer Privacy-By-Design Architecture

The project’s privacy model operates across distinct architectural layers defined in skills/deep-company-series.md and visualized in assets/architecture.png. Each layer contains specific enforcement mechanisms that prevent private data from penetrating the workflow.

Skill Layer: Public-Only Data Sources

All Skills—such as /investment-research and /private-company-research—are explicitly restricted to publicly-available sources. The skill specifications in skills/deep-company-series.md (lines 84-88) and skills/private-company-research.md (lines 20-23) define prohibited data categories that include company nicknames, internal IM logs, user-specific holdings, and any personal information subject to GDPR.

The private-company-research.md skill file explicitly states that contributors must use only "招股说明书、母公司公开财报、第三方行业报告（公开渠道）" (prospectuses, parent company public financial reports, third-party industry reports from public channels) and forbids "任何内部 IM、未公开持仓信息、个人化数据" (any internal IM, undisclosed holding information, or personalized data).

Agent Layer: Automated Privacy Scanning

Before any Agent output reaches the repository, a pre-push grep scan runs automatically to detect accidental leakage of private strings. As implemented in the workflow defined at skills/deep-company-series.md (lines 86-89), this scan searches for patterns such as the developer username linxuan, local file paths like /Users/…, and custom company nickname identifiers ("<用户公司花名>").

If the grep command detects any matches, the pipeline aborts immediately and prevents the content from being committed or shared externally. This "push-before-publish" script acts as a final privacy gatekeeper that operates after Agent processing but before Report Generation.

Tool Layer: Credential-Free Data Access

The Tool layer consists of purely functional utilities that never accept authentication tokens or API keys that could expose personal credentials. In tools/xueqiu_scraper.py (lines 8-15), all network calls target public Xueqiu endpoints that require no user-specific authentication. Similarly, tools/ashare_data.py fetches market data from Tencent’s open API without requiring API keys.

This design ensures that no secret credentials traverse the system, eliminating the risk of accidental credential leakage in logs or error messages.

Automated Privacy Guardrails in Practice

The repository implements concrete technical controls that enforce its privacy policy at runtime. These mechanisms are hard-coded into the workflow scripts and tool definitions.

Pre-Push Grep Scan Implementation

The following bash command runs automatically in every skill pipeline before publication, as embedded in the deep-company-series workflow:

# Built-in privacy guard that aborts on private data detection

grep -r "linxuan\|/Users/\|<用户公司花名>" reports/ | head

If this command returns any matches, the pipeline terminates and requires manual cleaning of the output. This prevents accidental inclusion of developer usernames, local file system paths, or internal company aliases in public reports.

Public-Only Data Retrieval Tools

All data fetching tools are architected to use only public endpoints. The ashare_data.py tool demonstrates this pattern:

# tools/ashare_data.py – fetches public A-share data without authentication

from ashare_data import fetch_price

price = fetch_price("000001.SZ")  # No API key required

print(f"Ping An Bank price: {price}")

This credential-free approach extends to all network operations in the codebase, including the Xueqiu scraper and financial calculation utilities in tools/financial_rigor.py.

Skill Definition Validation

The skill loader parses markdown constraint files that explicitly whitelist allowed data sources. The private-company-research skill definition includes:

# /private-company-research – 未上市公司深度研究

...
- **数据来源**：招股说明书、母公司公开财报、第三方行业报告（公开渠道）  
- **不使用**：任何内部 IM、未公开持仓信息、个人化数据

Attempts to reference private sources during skill execution trigger validation errors, enforcing compliance at the configuration level rather than relying on user discretion.

Key Implementation Files

Several critical files define and enforce AI-Berkshire’s privacy guarantees:

• README.md (lines 86-90): Introduces the privacy-first philosophy and states that "all calculations use public data only"
• skills/deep-company-series.md (lines 84-89): Contains the pre-push grep rule and the "合规与隐私" (Compliance & Privacy) clause
• skills/private-company-research.md (lines 20-23): Lists prohibited private data categories and enforces public-source restrictions
• tools/xueqiu_scraper.py (lines 8-15): Demonstrates public-endpoint network calls without authentication
• codex-skills/deep-company-series/SKILL.md (line 202): Mirrors privacy guards for Codex-generated skill packages, ensuring consistency across tooling chains

Summary

• AI-Berkshire implements a three-layer architecture (Skill → Agent → Tool) that isolates data processing and prevents private information from entering the system.
• Automated grep scanning runs before every publication, detecting accidental leakage of usernames, file paths, and internal identifiers.
• Credential-free tools ensure that no API keys or authentication tokens are exposed in logs or error messages.
• Public-source restrictions are hard-coded into skill definitions, with explicit prohibitions against internal IM logs, undisclosed holdings, and personalized data.
• The privacy policy is enforced through technical controls rather than human review, ensuring consistent compliance across all outputs.

Frequently Asked Questions

Does AI-Berkshire store any user data permanently?

No. According to the repository architecture in xbtlin/ai-berkshire, the system is designed to avoid any collection, storage, or leakage of private user data. All tools operate on ephemeral public data requests, and the skill specifications explicitly forbid processing personal or confidential information. No persistent storage layer exists for user-specific data.

How does AI-Berkshire prevent accidental credential leaks in reports?

The project implements a pre-push grep scan that automatically runs before any content is published. As defined in skills/deep-company-series.md, this scan searches for patterns like developer usernames (linxuan), local file paths (/Users/…), and internal company nicknames. If detected, the pipeline aborts immediately, preventing the commit from reaching the repository.

What types of data sources are permitted in AI-Berkshire research?

Only publicly-available sources are permitted, including official SEC filings, exchange-released reports, recognized third-party research, and open-web data. The private-company-research.md skill file explicitly prohibits internal IM logs, undisclosed holdings, personal identifiers, and any non-public confidential materials, ensuring compliance with privacy regulations like GDPR.

Are there any API keys or authentication tokens in the codebase?

No. All tools in the tools/ directory—such as ashare_data.py and xueqiu_scraper.py—are designed as purely functional utilities that query public endpoints without authentication. This credential-free design eliminates the risk of API key exposure and ensures that no personal credentials traverse the system during data retrieval operations.

{
  "mcpServers": {
    "instagit": {
      "command": "npx",
      "args": ["-y", "instagit@latest"]
    }
  }
}