Is AnythingLLM private? Kortix, the open-source AI Operating System, layer by layer

What "private" means at each layer

AnythingLLM is an open-source, local-first AI application built by Mintplex Labs. It runs on a desktop or in Docker, and it connects a local or cloud model to your documents. Its default vector database is the built-in LanceDB, which runs on the instance; the LanceDB docs state that with the default option your document text and embeddings never leave the AnythingLLM application.

Where AnythingLLM keeps its data

AnythingLLM Desktop keeps its state in one storage folder. Inside it, lancedb holds the vector database and its tables, documents holds the parsed content of uploaded files, models holds local model files, and anythingllm.db is the SQLite database. On Linux that folder is ~/.config/anythingllm-desktop/storage/, and the Docker version keeps the same layout in its mounted storage volume.

What can leave the machine

AnythingLLM collects anonymous usage telemetry through PostHog, and its README documents how to opt out. Set DISABLE_TELEMETRY="true" in the server or Docker .env, or turn telemetry off from the in-app Privacy section; the README states that no IP or other identifying information is collected. With telemetry off, an instance still connects out when you use an external model, embedding model or vector database, and it reaches cdn.anythingllm.com and GitHub to pull cached model files.

The layer AnythingLLM does not answer

AnythingLLM's boundary is the machine, and its multi-user controls stop at the workspace. A company also has to answer who inside it may reach which data, and which agent may reach it. In multi-user mode AnythingLLM shares an embedded document with everyone who can open the workspace, and it has no finer-grained permission than the workspace.

Kortix is the open-source AI Operating System, and it governs those layers. It gives per-resource permissions for people and agents, with roles, groups, and an audit trail. Connector credentials are brokered server-side and never enter the machine, so a company keeps its keys outside the run. See the Kortix docs on connectors.

For a secret that an agent's code should not read, Kortix can egress-enforce it: the sandbox holds a handle, and Kortix substitutes the real value outside the sandbox, only on approved HTTPS hosts. Environment is the default exposure, and egress-enforced is experimental. See the Kortix secrets docs.

Kortix also records what happened. Every action is recorded. Reading, exporting and streaming the audit log depend on the plan.

A company can keep the data inside its own boundary. Kortix runs on Kortix Cloud, in your VPC, or on your own on-prem network, and self-host is free. If you would rather run the document app too, self-hosting AnythingLLM without Docker covers that, and the open-source case for AnythingLLM compares the two self-hosted paths.