Core analysis is local
Imports, fits, plots, Compose, and export keep working offline; the network is for assistant and account calls.
What leaves the machine?
Your data never leaves your machine.
Autoplot sends intent and dataset schema, not raw values; you approve every local run.
The data boundary
Only the schema crosses the line.
The LLM Server sees intent and schema; raw values stay on your Mac.
Practical guarantees
What keeps the boundary intact.
Local execution, visible Python, sandboxed file access, and an infrastructure provider chosen for your data privacy.
Execution is visible
When Autoplot generates Python, you see it before it runs and can export the same local script.
Files stay scoped
File operations are sandboxed to the folder you choose; absolute paths, ~, and .. are rejected.
Provider chosen for privacy
We use an open-weight model on DeepInfra's U.S.-based infrastructure, and API data is not used for training.
Autoplot sends only request text and schema metadata, never raw dataset values. DeepInfra describes its infrastructure as secure U.S.-based data centers, and its inference data policy says submitted API data stays in memory during processing, is deleted after response, and is not used to train models.
Ready when you are
Join the waitlist if the privacy model is the kind you can actually explain.