Local does not automatically mean secure.
Silo North treats source access, permissions, malicious content, credentials and network exposure as engineering boundaries—not marketing adjectives.
WRITE ACCESS = OFF BY DEFAULT
Connectors should receive only the access required for ingestion. Legacy databases are read-only wherever possible.
UNKNOWN = FAIL CLOSED
A knowledge system should not casually reveal information a user could not access in the source system. Where preservation is incomplete, the limitation must be explicit.
SHELL EXECUTION = NONE
Retrieved text can contain prompt injection or malicious instructions. Source content is data, not authority to execute tools or commands.
ENVIRONMENT ≠ USER OUTPUT
Connector credentials and environment secrets should never appear in normal logs, reports or retrieved knowledge.
What we assume can go wrong.
Malicious documents. Poisoned indexed content. Over-broad source credentials. Incorrect permission mappings. Exposed network services. Broken parsers. Prompt injection. Secrets embedded in source material. Model or tool misuse.
The response is not “trust the AI.” It is to keep capabilities narrow, make ingestion observable, isolate commodity components, preserve provenance and fail visibly when a boundary cannot be maintained.
Private deployment
A Silo North installation can run on customer-controlled infrastructure with a local model runtime. That reduces unnecessary data movement, but it does not remove the need for patching, authentication, backups, network controls and least privilege.