Most privacy advice about AI is all-or-nothing: either go full local or accept that your prompts are training data. That framing misses how people actually work.

You probably don't need the same level of protection for researching "best PostgreSQL indexing strategies" as you do for drafting a client contract or analyzing payroll data. Treating every prompt identically — either locking everything down (and losing real productivity) or sending everything to the cloud (and losing control of your data) — is a false choice.

The better approach is compartmentalization: route each type of task to the appropriate tool based on data sensitivity, just like you'd classify documents in a security-conscious organization. This guide walks through a practical three-tier AI workflow you can implement today, with the specific tools and configuration to make it stick.

Last updated: 2026-06-18

Why Compartmentalization Works Better Than Blanket Rules

When researchers from Princeton studied how developers actually used AI coding assistants, they found a consistent pattern: people made context-based decisions about what to paste in. They weren't following formal policies — they were doing informal risk assessment in their heads.

The problem is that informal assessment is inconsistent. You'll paste a sanitized version of sensitive code on Monday and forget to sanitize on Friday at 4pm. A structured workflow makes the classification automatic, not something that depends on how tired you are.

The three tiers map to how most knowledge workers handle information:

Tier 1 (Public): Anything you'd be comfortable publishing. Research questions, generic how-tos, public data analysis.
Tier 2 (Internal): Work-related but not confidential. Project planning, non-identifying code, internal documentation drafts.
Tier 3 (Sensitive): Client data, PII, financial records, legal documents, unreleased product details, anything under NDA.

The goal is not to make each tier maximally paranoid. It's to match your privacy investment to the actual risk of each task.

Tier 1: Cloud AI for Public Queries

For genuinely public work — researching open-source tools, drafting blog posts on non-confidential topics, explaining concepts — cloud AI is fine, and often faster than local alternatives. The key is choosing a provider whose privacy posture you've actually read.

Most of the major chat AI products are explicit that they use conversation data for training by default. If you opt out, data retention policies vary from 30 days to indefinite depending on the service and whether you have a paid plan.

Perplexity Pro is worth examining for Tier 1 research tasks. Unlike most chat AI products, Perplexity's core product is search-augmented answers — so for factual research queries, it's pulling from live indexed sources rather than generating from training data. The Pro tier gives you access to multiple model backends and, critically, lets you run queries without logging in via the web interface if you prefer.

Affiliate Disclosure: This article may contain affiliate links. If you make a purchase through these links, we may earn a small commission at no extra cost to you. We only recommend products we genuinely believe in. This helps support our work and allows us to continue providing free content.

For Tier 1 tasks, the discipline to maintain is simple: don't paste anything you wouldn't publish. If you find yourself hesitating about whether something is okay to include in a prompt, that's the signal to move to Tier 2 or 3.

Configure your browser to use a separate profile for cloud AI tools. This keeps cookies, history, and login state isolated from your main browsing session. If you're on Chrome or Firefox, a dedicated profile takes 30 seconds to create and makes the context switch automatic.

Tier 2: Privacy-Respecting Cloud with Strict Prompt Discipline

Tier 2 is the trickiest tier because it's where most day-to-day work lives. You need AI assistance on real work tasks, but that work involves context that isn't fully public.

The discipline here is aggressive anonymization before prompting. Replace specific names, companies, and identifiers with generic placeholders before sending to any cloud tool. "The healthcare client in our Q3 pipeline" becomes "a client." Internal project codenames become "Project X." Real column names in a database schema become user_id, amount, timestamp.

This feels tedious, but it becomes fast with practice and a simple find-replace workflow. Keep a local text scrubber — even a shell script with sed replacements for your common internal terms — that you run on any text before it goes to Tier 2.

For Tier 2, provider selection matters more than Tier 1. Look for:

Explicit no-training-on-prompts policy for paid tiers
Data retention under 30 days (or zero retention options)
SOC 2 Type II certification
No third-party data sharing for ad targeting

Document your decisions. If you're ever asked to justify your AI tool choices to a client or compliance officer, having a written rationale for why you chose each tool for each task class is worth far more than scrambling to explain after the fact.

Tier 3: Local LLM Only — No Exceptions

For anything that would constitute a data breach if it leaked to a third party, the answer is a local LLM with no network access. This isn't paranoia — it's the only technically sound position. No cloud provider's privacy policy can protect you from their own server compromise, a subpoena, or a misconfigured API key.

Setting up a local LLM workflow is now genuinely accessible. Here's the minimum viable stack:

Ollama (ollama.com) handles model management and serves a local API. Install it, pull a model, and you have a private endpoint at localhost:11434 that behaves like the OpenAI API — so any tool built for GPT-4 can be pointed at your local model instead.

```bash

Install on macOS

brew install ollama

Pull a capable 7B model (~4GB)

ollama pull mistral

Or pull a larger model if you have the RAM

ollama pull llama3.1:8b

```

Open WebUI gives you a chat interface that looks like ChatGPT, runs in your browser, and never sends a packet outside your machine.

```bash

docker run -d -p 3000:80 \

-v open-webui:/app/backend/data \

--name open-webui \

ghcr.io/open-webui/open-webui:main

```

Navigate to localhost:3000, connect it to your Ollama endpoint, and you have a fully private chat interface.

Hardware realism: A decent 7B parameter model runs acceptably on 16GB RAM (8GB VRAM if you're using a GPU). For code generation and document analysis tasks that most tech workers need, mistral:7b or llama3.1:8b will cover 80% of use cases. If you're doing anything involving long documents, look at mixtral:8x7b — it's heavier but handles context better.

Air-gap the Tier 3 session. When working with sensitive documents, disable WiFi before opening your local model interface. Paranoid, yes. But if you're handling client data or material under NDA, the cost of a minute of airplane mode is zero and the downside risk of an unexpected background sync is not.

Keeping Your Document Layer Private

The workflow above handles the AI interaction layer. The document layer — where your sensitive files actually live between sessions — needs its own solution.

Most people default to whatever cloud storage they already use: Dropbox, Google Drive, OneDrive. These are fine for non-sensitive documents but provide essentially no protection against provider-side access. Your documents are encrypted in transit and at rest against external attackers, but not against the provider itself.

Tresorit is the practical alternative for sensitive document storage. It uses end-to-end encryption where the key never touches Tresorit's servers — meaning neither Tresorit nor law enforcement can read your files without your passphrase. The UI is close enough to Dropbox that the workflow change is minimal.

For the Tier 3 workflow specifically, the pattern is:

Files live in Tresorit (encrypted at rest, you hold the key)
Download to local machine only when working with them
Process with local LLM (no network)
Results stay local or return to Tresorit
Nothing touches cloud AI at any point in the chain

This is the data sovereignty model that financial services and legal teams have been using for file sharing for years. Applying it to AI workflows just closes the last gap.

Network Layer: Don't Forget the Metadata

Even a perfect local LLM setup leaks metadata at the network layer. When you download models, access documentation, or do any incidental browsing related to a project, your ISP and network-level observers see DNS queries and traffic patterns.

Proton VPN with the NetShield DNS filter active routes all DNS through Proton's servers and blocks tracking domains before they resolve. For tech workers whose threat model includes nosy ISPs or shared office networks (both of which are more common than people acknowledge), this closes a real gap at low friction.

The Proton ecosystem has an additional practical advantage: Proton Mail with a custom domain gives you end-to-end encrypted email that works with the same zero-knowledge key management model as Tresorit. If you're forwarding client documents via email before processing them locally, having that email transport encrypted end-to-end matters.

Operationalizing the Three Tiers

The workflow is only useful if it runs on autopilot. Here's how to make it stick:

Create a decision card. A single sticky note or pinned doc with the three-tier criteria. Read it when you start a task, not after you've already drafted a prompt. The question to answer: "Would I be uncomfortable if this exact text appeared in a public dataset?"

Set up physical or digital signals for Tier 3. When you're doing Tier 3 work, WiFi off, local interface open. The physical action of toggling WiFi creates a context anchor that's harder to forget than a mental note.

Do a weekly prompt audit. Most cloud AI chat interfaces let you export your conversation history. Once a week, spend five minutes reviewing what you sent in the past seven days. This is where you'll catch the inevitable classification mistakes — and the pattern of your mistakes will tell you where your workflow needs strengthening.

Document your tool choices for clients. If you do contract or consulting work, proactively informing clients about your AI data handling policies is increasingly a differentiator. Clients don't assume you have a policy; they assume you don't. Having one, and being able to describe it, builds trust faster than almost any other practice.

The Realistic Starting Point

You don't need to implement all three tiers simultaneously. If you're starting from zero, pick one:

Install Ollama and pull mistral:7b this afternoon. Run two tasks through it that you'd normally send to a cloud model. See how it feels.
Create a browser profile dedicated to cloud AI tools and start using it consistently.
Move one category of client documents to Tresorit and see if the workflow is tolerable.

The goal is to build habits one tier at a time. Trying to overhaul your entire AI workflow in a weekend is how you end up reverting to your previous defaults within two weeks.

Privacy isn't a binary state. It's a practice. A three-tier workflow gives you most of the protection of "never use cloud AI" at a fraction of the productivity cost — which means you'll actually keep doing it.

Want more privacy workflow guides in your inbox? We publish practical, no-hype AI privacy analysis for people who need real answers, not threat theater. Drop your email below and we'll send the next one when it's ready.

Stay Updated

Join our newsletter for the latest updates.